@shivaedev/errors 0.4.1 → 0.6.0

package/dist/wireMask.js

@@ -0,0 +1,88 @@
+import { Effect, Exit, Predicate, Schema } from "effect";
+import { REDACTED } from "#sensitive.ts";
+export class InvalidRedactionMask extends Schema.TaggedError()("InvalidRedactionMask", {
+    field: Schema.String,
+    message: Schema.String,
+}) {
+}
+const objectMask = Effect.fnUntraced(function* (ast, field, seen) {
+    const entries = [];
+    for (const property of ast.propertySignatures) {
+        if (!property.type.context?.isOptional) {
+            entries.push([property.name, yield* wireMask(property.type, `${field}.${String(property.name)}`, seen)]);
+        }
+    }
+    return Object.fromEntries(entries);
+});
+const arrayMask = Effect.fnUntraced(function* (ast, field, seen) {
+    const items = [];
+    for (const [index, element] of ast.elements.entries()) {
+        if (!element.context?.isOptional) {
+            items.push(yield* wireMask(element, `${field}[${index}]`, seen));
+        }
+    }
+    return items;
+});
+const unionMask = Effect.fnUntraced(function* (ast, field, seen) {
+    for (const member of ast.types) {
+        const candidate = yield* Effect.result(wireMask(member, field, seen));
+        if (candidate._tag === "Success") {
+            return candidate.success;
+        }
+    }
+    return undefined;
+});
+function genericMask(ast, field, seen) {
+    switch (ast._tag) {
+        case "String":
+        case "Unknown":
+        case "Any":
+            return Effect.succeed(REDACTED);
+        case "Number":
+            return Effect.succeed(0);
+        case "Boolean":
+            return Effect.succeed(false);
+        case "Null":
+            return Effect.succeed(null);
+        case "Undefined":
+        case "Void":
+            return Effect.succeed(undefined);
+        case "Literal":
+            return Effect.succeed(ast.literal);
+        case "Objects":
+            return objectMask(ast, field, seen);
+        case "Arrays":
+            return arrayMask(ast, field, seen);
+        case "Union":
+            return unionMask(ast, field, seen);
+        case "Suspend":
+            return wireMask(ast.thunk(), field, seen);
+        default:
+            return Effect.succeed(REDACTED);
+    }
+}
+export const wireMask = Effect.fnUntraced(function* (ast, field, ancestors = new Set()) {
+    function invalid() {
+        return new InvalidRedactionMask({
+            field,
+            message: `Sensitive field "${field}" needs a schema-compatible mask; supply a redactionMask annotation on its wire schema.`,
+        });
+    }
+    if (ancestors.has(ast)) {
+        return yield* invalid();
+    }
+    const seen = new Set(ancestors).add(ast);
+    const Annotations = Schema.resolveAnnotations(Schema.make(ast));
+    let value;
+    if (Predicate.hasProperty(Annotations, "redactionMask")) {
+        value = Annotations.redactionMask;
+    }
+    else {
+        value = ast.encoding === undefined ? yield* genericMask(ast, field, seen) : yield* wireMask(ast.encoding.at(-1)?.to ?? ast, field, seen);
+    }
+    if (Exit.isFailure(Schema.decodeUnknownExit(Schema.toCodecJson(Schema.make(ast)))(value))) {
+        return yield* invalid();
+    }
+    return value;
+});
+//# sourceMappingURL=wireMask.js.map

package/dist/wireMask.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wireMask.js","sourceRoot":"","sources":["../src/wireMask.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAkB,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,MAAM,OAAO,oBAAqB,SAAQ,MAAM,CAAC,WAAW,EAAwB,CAAC,sBAAsB,EAAE;IAC5G,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM;CACtB,CAAC;CAAG;AAIL,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,GAAsB,EAAE,KAAa,EAAE,IAAe;IACrG,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,KAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1G,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AACH,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,GAAqB,EAAE,KAAa,EAAE,IAAe;IACnG,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAClE,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC,CAAC,CAAC;AACH,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,GAAoB,EAAE,KAAa,EAAE,IAAe;IAClG,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACtE,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC,OAAO,CAAC;QAC1B,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC,CAAC;AACH,SAAS,WAAW,CAAC,GAAkB,EAAE,KAAa,EAAE,IAAe;IACtE,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,KAAK;YACT,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjC,KAAK,QAAQ;YACZ,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,KAAK,SAAS;YACb,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,KAAK,MAAM;YACV,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,KAAK,WAAW,CAAC;QACjB,KAAK,MAAM;YACV,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,KAAK,SAAS;YACb,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpC,KAAK,SAAS;YACb,OAAO,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,KAAK,QAAQ;YACZ,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACpC,KAAK,OAAO;YACX,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACpC,KAAK,SAAS;YACb,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3C;YACC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAClD,GAAkB,EAClB,KAAa,EACb,SAAS,GAAc,IAAI,GAAG,EAAE;IAEhC,SAAS,OAAO;QACf,OAAO,IAAI,oBAAoB,CAAC;YAC/B,KAAK;YACL,OAAO,EAAE,oBAAoB,KAAK,yFAAyF;SAC3H,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,IAAI,KAAc,CAAC;IACnB,IAAI,SAAS,CAAC,WAAW,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;QACzD,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC;IACnC,CAAC;SAAM,CAAC;QACP,KAAK,GAAG,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1I,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAwB,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAClH,OAAO,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC,CAAC,CAAC"}

package/dist/wireRedactor.d.ts

@@ -0,0 +1,6 @@
+import { Effect, type SchemaAST } from "effect";
+import { type SensitiveKey } from "#sensitive.ts";
+type Redactor = (value: unknown) => unknown;
+export declare const wireRedactor: (ast: SchemaAST.AST, field: string, sensitive: SensitiveKey, keys: ReadonlySet<string>) => Effect.Effect<Redactor, import("#wireMask.ts").InvalidRedactionMask, never>;
+export {};
+//# sourceMappingURL=wireRedactor.d.ts.map

package/dist/wireRedactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wireRedactor.d.ts","sourceRoot":"","sources":["../src/wireRedactor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAqB,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGnE,OAAO,EAAY,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAG5D,KAAK,QAAQ,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;AAyB5C,eAAO,MAAM,YAAY,wKAmGvB,CAAC"}

package/dist/wireRedactor.js

@@ -0,0 +1,105 @@
+import { Effect, Predicate, Schema } from "effect";
+import { redactWire } from "#redact.ts";
+import { collect, maskedValue, sensitiveEncoding } from "#schemaSensitiveAst.ts";
+import { REDACTED } from "#sensitive.ts";
+import { wireMask } from "#wireMask.ts";
+function objectRedactor(fields, indexes, sensitive) {
+    function field(key) {
+        const property = fields.get(key);
+        if (property !== undefined) {
+            return property;
+        }
+        const index = indexes.find((entry) => entry.accepts(key));
+        if (index !== undefined) {
+            return sensitive(key) ? index.mask : index.apply;
+        }
+        return (value) => (sensitive(key) ? REDACTED : redactWire(value, sensitive));
+    }
+    return (value) => Predicate.isObjectOrArray(value)
+        ? Object.fromEntries(Object.entries(value).map(([key, nested]) => [key, field(key)(nested)]))
+        : redactWire(value, sensitive);
+}
+export const wireRedactor = Effect.fnUntraced(function* (ast, field, sensitive, keys) {
+    const cache = new Map();
+    function constrainedContainer(node) {
+        if (node.checks === undefined) {
+            return false;
+        }
+        const nodes = new Set();
+        collect(node, nodes);
+        return [...nodes].some((child) => child._tag === "Objects" && child.propertySignatures.some((property) => typeof property.name === "string" && sensitive(property.name)));
+    }
+    function encoded(node) {
+        if (node.encoding !== undefined) {
+            return node.encoding.at(-1)?.to ?? node;
+        }
+        return node._tag === "Declaration" ? Schema.toEncoded(Schema.toCodecJson(Schema.make(node))).ast : node;
+    }
+    const compileObject = Effect.fnUntraced(function* (node, path) {
+        const fields = new Map();
+        for (const property of node.propertySignatures) {
+            const stackHeader = property.name === "stack" && (sensitive("message") || sensitive("name"));
+            fields.set(property.name, yield* compile(property.type, `${path}.${String(property.name)}`, stackHeader || (typeof property.name === "string" && sensitive(property.name))));
+        }
+        const indexes = yield* Effect.forEach(node.indexSignatures, (index) => Effect.gen(function* () {
+            const apply = yield* compile(index.type, `${path}[value]`);
+            const mask = yield* compile(index.type, `${path}[value]`, true);
+            return { accepts: Schema.is(Schema.make(index.parameter)), apply, mask };
+        }));
+        return objectRedactor(fields, indexes, sensitive);
+    });
+    const compileArray = Effect.fnUntraced(function* (node, path) {
+        const elements = yield* Effect.forEach(node.elements, (element, index) => compile(element, `${path}[${index}]`));
+        const rest = yield* Effect.forEach(node.rest, (element) => compile(element, `${path}[]`));
+        return (value) => Array.isArray(value)
+            ? value.map((item, index) => (elements[index] ?? rest[0] ?? ((entry) => redactWire(entry, sensitive)))(item))
+            : redactWire(value, sensitive);
+    });
+    const compileUnion = Effect.fnUntraced(function* (node, path) {
+        const members = yield* Effect.forEach(node.types, (member, index) => Effect.map(compile(member, `${path}[${index}]`), (mask) => ({
+            accepts: Schema.is(Schema.toEncoded(Schema.toCodecJson(Schema.make(member)))),
+            mask,
+        })));
+        return (value) => {
+            const member = members.find(({ accepts }) => accepts(value));
+            return member === undefined ? REDACTED : member.mask(value);
+        };
+    });
+    function contents(node, path) {
+        switch (node._tag) {
+            case "Objects":
+                return compileObject(node, path);
+            case "Arrays":
+                return compileArray(node, path);
+            case "Union":
+                return compileUnion(node, path);
+            case "Suspend":
+                return compile(node.thunk(), path);
+            default:
+                return Effect.succeed((value) => redactWire(value, sensitive));
+        }
+    }
+    function compile(node, path, hidden = false) {
+        return Effect.gen(function* () {
+            if (hidden
+                || constrainedContainer(node)
+                || sensitiveEncoding(node, keys)
+                || (node._tag !== "Union" && maskedValue(node, keys))
+                || Schema.resolveAnnotations(Schema.make(node))?.sensitive === true) {
+                const mask = yield* wireMask(node, path);
+                return () => mask;
+            }
+            const cached = cache.get(node);
+            if (cached !== undefined) {
+                return cached;
+            }
+            let apply = () => REDACTED;
+            const redactor = (value) => apply(value);
+            cache.set(node, redactor);
+            apply = yield* contents(encoded(node), path);
+            return redactor;
+        });
+    }
+    return yield* compile(ast, field);
+});
+//# sourceMappingURL=wireRedactor.js.map

package/dist/wireRedactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wireRedactor.js","sourceRoot":"","sources":["../src/wireRedactor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAkB,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAqB,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AASxC,SAAS,cAAc,CAAC,MAA0C,EAAE,OAAiC,EAAE,SAAuB;IAC7H,SAAS,KAAK,CAAC,GAAW;QACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,CAAC,KAAK,EAAE,EAAE,CAChB,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC;QAC/B,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7F,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,GAAkB,EAAE,KAAa,EAAE,SAAuB,EAAE,IAAyB;IAC7I,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,SAAS,oBAAoB,CAAC,IAAmB;QAChD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;QACvC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CACrB,CAAC,KAAK,EAAE,EAAE,CACT,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACvI,CAAC;IACH,CAAC;IACD,SAAS,OAAO,CAAC,IAAmB;QACnC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACzG,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAuB,EAAE,IAAY;QACvF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;QAChD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChD,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7F,MAAM,CAAC,GAAG,CACT,QAAQ,CAAC,IAAI,EACb,KAAK,CAAC,CAAC,OAAO,CACb,QAAQ,CAAC,IAAI,EACb,GAAG,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAClC,WAAW,IAAI,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC9E,CACD,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CACrE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACnB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;YAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,SAAS,EAAE,IAAI,CAAC,CAAC;YAChE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC1E,CAAC,CAAC,CACF,CAAC;QACF,OAAO,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAsB,EAAE,IAAY;QACrF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;QACjH,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;QAC1F,OAAO,CAAC,KAAK,EAAE,EAAE,CAChB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACnB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7G,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAqB,EAAE,IAAY;QACpF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACnE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3D,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7E,IAAI;SACJ,CAAC,CAAC,CACH,CAAC;QACF,OAAO,CAAC,KAAK,EAAE,EAAE;YAChB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,SAAS,QAAQ,CAAC,IAAmB,EAAE,IAAY;QAClD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,SAAS;gBACb,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAClC,KAAK,QAAQ;gBACZ,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,KAAK,OAAO;gBACX,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,KAAK,SAAS;gBACb,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;YACpC;gBACC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QACjE,CAAC;IACF,CAAC;IACD,SAAS,OAAO,CAAC,IAAmB,EAAE,IAAY,EAAE,MAAM,GAAG,KAAK;QACjE,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC1B,IACC,MAAM;mBACH,oBAAoB,CAAC,IAAI,CAAC;mBAC1B,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC;mBAC7B,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;mBAClD,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,KAAK,IAAI,EAClE,CAAC;gBACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACzC,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;YACnB,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,MAAM,CAAC;YACf,CAAC;YACD,IAAI,KAAK,GAAa,GAAG,EAAE,CAAC,QAAQ,CAAC;YACrC,MAAM,QAAQ,GAAa,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACnD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC1B,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;YAC7C,OAAO,QAAQ,CAAC;QACjB,CAAC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shivaedev/errors",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Typed expected failures and secret-safe failure reporting for Effect applications",
   "keywords": [
     "effect"
@@ -45,9 +45,8 @@
     "README.md"
   ],
   "devDependencies": {
-    "@shivaedev/quality": "0.53.1",
-    "@shivaedev/test": "0.12.0",
-    "@shivaedev/test-story": "0.31.4",
+    "@shivaedev/quality": "0.57.0",
+    "@shivaedev/test-story": "0.35.0",
     "@types/node": "24.19.2",
     "effect": "4.0.6",
     "typescript": "7.0.2",

package/src/boundary.ts

@@ -19,6 +19,19 @@ function reportUnexpected(cause: Cause.Cause<unknown>): Effect.Effect<void> {
 		),
 	);
 }
+function declaredCause<E>(cause: Cause.Cause<unknown>, declared: (value: unknown) => value is E): Cause.Cause<E> | undefined {
+	const reasons: Cause.Reason<E>[] = [];
+	for (const reason of cause.reasons) {
+		if (Cause.isInterruptReason(reason)) {
+			reasons.push(reason);
+		} else if (Cause.isFailReason(reason) && declared(reason.error)) {
+			reasons.push(Cause.makeFailReason(reason.error).annotate(Context.makeUnsafe(reason.annotations)));
+		} else {
+			return undefined;
+		}
+	}
+	return Cause.fromReasons(reasons);
+}
 export interface RpcBoundaryOptions<E> {
 	readonly message?: string;
 	readonly unexpected: (message: string) => E;
@@ -34,9 +47,9 @@ export function rpcBoundary<
 			if (Cause.hasInterruptsOnly(cause)) {
 				return Effect.failCause(Cause.fromReasons(cause.reasons.filter(Cause.isInterruptReason)));
 			}
-			const reason = cause.reasons[0];
-			if (cause.reasons.length === 1 && reason && Cause.isFailReason(reason) && declared(reason.error)) {
-				return Effect.fail(reason.error);
+			const expected = declaredCause(cause, declared);
+			if (expected !== undefined) {
+				return Effect.failCause(expected);
 			}
 			const rejection = options.unexpected(redactText(options.message ?? "Internal server error", isSensitiveKey));
 			Object.defineProperties(rejection, {

package/src/redactBrowserText.ts

@@ -0,0 +1,6 @@
+import { isSensitiveKey, REDACTED, redactText, type SensitiveKey } from "#sensitive.ts";
+
+export function redactBrowserText(text: string, sensitive: SensitiveKey = isSensitiveKey): string {
+	const masked = text.replaceAll(/(?<quote>["`]|(?<![\p{L}\p{N}_])')(?:\\[\s\S]|(?!\k<quote>)[^\\])*\k<quote>/gu, `$<quote>${REDACTED}$<quote>`);
+	return redactText(masked, sensitive);
+}

package/src/rpcBoundaryHandlers.ts

@@ -1,7 +1,7 @@
-import { Effect, Stream } from "effect";
-import { Rpc, type RpcGroup, type RpcSchema } from "effect/rpc";
+import { Effect, Result, Stream } from "effect";
+import { Rpc, type RpcGroup, RpcSchema } from "effect/rpc";
 
-type Result = Effect.Effect<unknown, unknown, unknown> | Stream.Stream<unknown, unknown, unknown>;
+type HandlerResult = Effect.Effect<unknown, unknown, unknown> | Stream.Stream<unknown, unknown, unknown>;
 type Handlers<R extends Rpc.Any> = {
 	readonly [TRpc in R as TRpc["_tag"]]: (
 		...args: Parameters<Rpc.ToHandlerFn<TRpc>>
@@ -31,17 +31,24 @@ export function rpcBoundaryHandlers<TRpcs extends Rpc.Any, E, THandlers extends
 	handlers: THandlers,
 ): BoundedHandlers<THandlers, E>;
 export function rpcBoundaryHandlers(
-	_group: RpcGroup.RpcGroup<Rpc.Any>,
+	group: RpcGroup.RpcGroup<Rpc.Any>,
 	boundary: <A, TError, R>(effect: Effect.Effect<A, TError, R>) => Effect.Effect<A, unknown, R>,
-	handlers: Readonly<Record<string, (...args: never[]) => Rpc.WrapperOr<Result>>>,
+	handlers: Readonly<Record<string, (...args: never[]) => Rpc.WrapperOr<HandlerResult>>>,
 ) {
 	return Object.fromEntries(
-		Object.entries<(...args: never[]) => Rpc.WrapperOr<Result>>(handlers).map(([tag, handler]) => [
+		Object.entries<(...args: never[]) => Rpc.WrapperOr<HandlerResult>>(handlers).map(([tag, handler]) => [
 			tag,
-			(...args: never[]) =>
-				Rpc.wrapMap(handler(...args), (result) =>
+			(...args: never[]) => {
+				const constructed = Result.try(() => handler(...args));
+				if (Result.isFailure(constructed)) {
+					const failure = boundary(Effect.die(constructed.failure));
+					const rpc = group.requests.get(tag);
+					return Rpc.isRpc(rpc) && RpcSchema.isStreamSchema(rpc.successSchema) ? Stream.fromEffect(failure) : failure;
+				}
+				return Rpc.wrapMap(constructed.success, (result) =>
 					Effect.isEffect(result) ? boundary(result) : Stream.catchCause(result, (cause) => Stream.fromEffect(boundary(Effect.failCause(cause)))),
-				),
+				);
+			},
 		]),
 	);
 }

package/src/schemaFieldScope.ts

@@ -27,45 +27,61 @@ interface Field {
 
 function fieldsOf(ast: SchemaAST.AST, schema: string, extra: readonly string[], candidates: ReadonlySet<string>): Field[] {
 	const fields: Field[] = [];
-	function visitIndex(index: SchemaAST.IndexSignature, path: string, hidden: boolean, seen: ReadonlySet<SchemaAST.AST>) {
+	function visitIndex(
+		index: SchemaAST.IndexSignature,
+		path: string,
+		hidden: boolean,
+		seen: ReadonlySet<SchemaAST.AST>,
+		encoded: ReadonlySet<string>,
+	) {
 		const accepts = Schema.is(Schema.make(index.parameter));
 		for (const key of candidates) {
 			if (accepts(key)) {
-				fields.push({ key, path: `${path}[${key}]`, sensitive: hidden || extra.includes(key) || isSensitiveKey(key) });
+				fields.push({ key, path: `${path}[${key}]`, sensitive: hidden || encoded.has(key) || extra.includes(key) || isSensitiveKey(key) });
 			}
 		}
-		visit(index.type, `${path}[value]`, hidden, seen);
+		visit(index.type, `${path}[value]`, hidden, seen, encoded);
 	}
-	function visitObject(node: SchemaAST.Objects, path: string, hidden: boolean, seen: ReadonlySet<SchemaAST.AST>) {
+	function visitObject(node: SchemaAST.Objects, path: string, hidden: boolean, seen: ReadonlySet<SchemaAST.AST>, encoded: ReadonlySet<string>) {
 		for (const property of node.propertySignatures) {
 			if (typeof property.name !== "string") {
 				continue;
 			}
 			const sensitive =
-				hidden || extra.includes(property.name) || isSensitiveKey(property.name) || maskedValue(property.type, schemaFieldKeys(property.type, []));
+				hidden
+				|| encoded.has(property.name)
+				|| extra.includes(property.name)
+				|| isSensitiveKey(property.name)
+				|| maskedValue(property.type, schemaFieldKeys(property.type, []));
 			const fieldPath = `${path}.${property.name}`;
 			fields.push({ key: property.name, path: fieldPath, sensitive });
-			visit(property.type, fieldPath, sensitive, seen);
+			visit(property.type, fieldPath, sensitive, seen, encoded);
 		}
 		for (const index of node.indexSignatures) {
-			visitIndex(index, path, hidden, seen);
+			visitIndex(index, path, hidden, seen, encoded);
 		}
 	}
-	function visit(node: SchemaAST.AST, path: string, hidden: boolean, ancestors: ReadonlySet<SchemaAST.AST>) {
+	function visit(node: SchemaAST.AST, path: string, hidden: boolean, ancestors: ReadonlySet<SchemaAST.AST>, encoded: ReadonlySet<string>) {
 		if (ancestors.has(node)) {
 			return;
 		}
 		const seen = new Set(ancestors).add(node);
 		const masked = hidden || marked(node);
 		if (node._tag === "Objects") {
-			visitObject(node, path, masked, seen);
-			return;
+			visitObject(node, path, masked, seen, encoded);
+		} else {
+			for (const [index, child] of children(node).entries()) {
+				visit(child, `${path}[${index}]`, masked, seen, encoded);
+			}
 		}
-		for (const [index, child] of children(node).entries()) {
-			visit(child, `${path}[${index}]`, masked, seen);
+		if (node.encoding !== undefined) {
+			const keys = new Set([...encoded, ...schemaFieldKeys(node, [])]);
+			for (const link of node.encoding) {
+				visit(link.to, `${path}.encoded`, masked, seen, keys);
+			}
 		}
 	}
-	visit(ast, schema, false, new Set());
+	visit(ast, schema, false, new Set(), new Set());
 	for (const key of schemaFieldKeys(ast, [])) {
 		if (!fields.some((field) => field.key === key && field.sensitive)) {
 			fields.push({ key, path: `${schema}.encoded.${key}`, sensitive: true });

package/src/schemaSensitiveAst.ts

@@ -43,6 +43,9 @@ function containsSensitive(ast: SchemaAST.AST, keys: ReadonlySet<string>): boole
 	);
 }
 function preservesFields(source: SchemaAST.AST, target: SchemaAST.AST): boolean {
+	if (source._tag === "Declaration" && source.annotations?.["~constructor"] !== undefined && source.typeParameters[0] === target) {
+		return true;
+	}
 	return (
 		source._tag === "Declaration"
 		&& Predicate.hasProperty(source.annotations?.representation, "id")
@@ -70,6 +73,16 @@ export function collectEncodedKeys(ast: SchemaAST.AST, keys: Set<string>) {
 		source = link.to;
 	}
 }
+export function sensitiveEncoding(ast: SchemaAST.AST, keys: ReadonlySet<string>): boolean {
+	let source = ast;
+	for (const link of ast.encoding ?? []) {
+		if (!preservesFields(source, link.to) && (containsSensitive(source, keys) || containsSensitive(link.to, keys))) {
+			return true;
+		}
+		source = link.to;
+	}
+	return false;
+}
 function fixedOutput(ast: SchemaAST.AST): boolean {
 	if (ast._tag === "Union") {
 		return ast.types.every(fixedOutput);

package/src/schemaSensitiveKeys.ts

@@ -2,21 +2,30 @@ import { Effect } from "effect";
 import { Rpc, type RpcGroup } from "effect/rpc";
 import { schemaFieldKeys, validateFieldScope } from "#schemaFieldScope.ts";
 import { maskedValue } from "#schemaSensitiveAst.ts";
-import { isSensitiveKey } from "#sensitive.ts";
+import { isSensitiveKey, REDACTED } from "#sensitive.ts";
+import { wireRedactor } from "#wireRedactor.ts";
 
 const rpcSensitiveKeys = Effect.fnUntraced(function* (rpc: Rpc.AnyWithProps, extra: readonly string[]) {
+	const Errors = Rpc.exitSchema(rpc).error;
 	const schemas = [
 		{ ast: rpc.payloadSchema.ast, name: `${rpc._tag}.payload` },
 		{ ast: rpc.successSchema.ast, name: `${rpc._tag}.success` },
 		{ ast: rpc.errorSchema.ast, name: `${rpc._tag}.error` },
 		{ ast: rpc.defectSchema.ast, name: `${rpc._tag}.defect` },
 		...[...rpc.middlewares].map((middleware, index) => ({ ast: middleware.error.ast, name: `${rpc._tag}.middleware[${index}].error` })),
+		{ ast: Errors.ast, name: `${rpc._tag}.exit.error` },
 	];
 	yield* validateFieldScope(schemas, extra);
 	const keys = new Set(schemas.flatMap(({ ast }) => [...schemaFieldKeys(ast, extra)]));
-	return Object.assign((key: string) => keys.has(key) || isSensitiveKey(key), {
+	function sensitive(key: string) {
+		return keys.has(key) || isSensitiveKey(key);
+	}
+	const fail = yield* wireRedactor(Errors.ast, `${rpc._tag}.error`, sensitive, keys);
+	const die = yield* wireRedactor(rpc.defectSchema.ast, `${rpc._tag}.defect`, sensitive, keys);
+	return Object.assign(sensitive, {
 		die: maskedValue(rpc.defectSchema.ast, keys),
-		fail: [rpc.errorSchema, ...[...rpc.middlewares].map((m) => m.error)].some((schema) => maskedValue(schema.ast, keys)),
+		fail: maskedValue(Errors.ast, keys),
+		redactFailure: (reason: "Fail" | "Die", value: unknown) => (reason === "Fail" ? fail(value) : die(value)),
 	});
 });
 export const schemaSensitiveKeys = Effect.fnUntraced(function* <R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, extra: readonly string[] = []) {
@@ -33,5 +42,9 @@ export const schemaSensitiveKeys = Effect.fnUntraced(function* <R extends Rpc.An
 		forRpc: (tag: string | undefined) => (tag === undefined ? sensitive : (policies.get(tag) ?? sensitive)),
 		maskFailure: (tag: string | undefined, reason: "Fail" | "Die") =>
 			[...policies].some(([method, policy]) => (tag === undefined || tag === method) && (reason === "Fail" ? policy.fail : policy.die)),
+		redactFailure: (tag: string | undefined, reason: "Fail" | "Die", value: unknown) => {
+			const policy = policies.get(tag ?? "");
+			return policy === undefined ? REDACTED : policy.redactFailure(reason, value);
+		},
 	});
 });

package/src/sensitive.ts

@@ -44,14 +44,17 @@ const AUTH_SCHEME = /\b(?<scheme>Bearer|Basic)\s+[A-Za-z0-9%._~+/-]+=*/giu;
 const JWT = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/gu;
 const PRIVATE_KEY = /-----BEGIN (?<kind>(?:[A-Z0-9]+ )*PRIVATE KEY)-----[\s\S]*?-----END \k<kind>-----/gu;
 function redactAssignments(text: string, sensitive: SensitiveKey): string {
-	const matcher = /(?<key>[A-Za-z][\w.-]*)(?<separator>["']?\s*[=:]\s*["']?)(?<value>[^\s"'&,;]+)/gu;
+	const matcher =
+		/(?<key>[A-Za-z][\w.-]*)(?<separator>["']?\s*[=:]\s*)(?<value>(?<quote>["'])(?:\\[\s\S]?|(?!\k<quote>)[^\\])*(?<closingQuote>\k<quote>|$)|[^\s"'&,;]+)/gu;
 	let result = "";
 	let cursor = 0;
 	for (let match = matcher.exec(text); match !== null; match = matcher.exec(text)) {
 		const key = match[1] ?? "";
 		const separator = match[2] ?? "";
 		if (sensitive(key)) {
-			result += `${text.slice(cursor, match.index)}${key}${separator}${REDACTED}`;
+			const quote = match.groups?.quote ?? "";
+			const closingQuote = match.groups?.closingQuote ?? "";
+			result += `${text.slice(cursor, match.index)}${key}${separator}${quote}${REDACTED}${closingQuote}`;
 			cursor = matcher.lastIndex;
 		} else if (match[3]?.includes("=")) {
 			// Revisit embedded parameters without parsing URL and source-location colons as assignments.

package/src/taxonomy.ts

@@ -8,7 +8,11 @@ export class Forbidden extends Schema.TaggedError<Forbidden>()("Forbidden", desc
 export class BadRequest extends Schema.TaggedError<BadRequest>()("BadRequest", perField) {}
 export class Conflict extends Schema.TaggedError<Conflict>()("Conflict", perField) {}
 export class PreconditionFailed extends Schema.TaggedError<PreconditionFailed>()("PreconditionFailed", described) {}
-export class TooManyRequests extends Schema.TaggedError<TooManyRequests>()("TooManyRequests", described) {}
+export class TooManyRequests extends Schema.TaggedError<TooManyRequests>()("TooManyRequests", {
+	...described,
+	key: Schema.optionalKey(Schema.String),
+	retryAt: Schema.optionalKey(Schema.Number),
+}) {}
 export class AuthUnavailable extends Schema.TaggedError<AuthUnavailable>()("AuthUnavailable", described) {}
 export class InternalServerError extends Schema.TaggedError<InternalServerError>()("InternalServerError", described) {}
 export class ServiceUnavailable extends Schema.TaggedError<ServiceUnavailable>()("ServiceUnavailable", described) {}

package/src/wireMask.ts

@@ -0,0 +1,94 @@
+import { Effect, Exit, Predicate, Schema, type SchemaAST } from "effect";
+import { REDACTED } from "#sensitive.ts";
+
+export class InvalidRedactionMask extends Schema.TaggedError<InvalidRedactionMask>()("InvalidRedactionMask", {
+	field: Schema.String,
+	message: Schema.String,
+}) {}
+
+type Ancestors = ReadonlySet<SchemaAST.AST>;
+
+const objectMask = Effect.fnUntraced(function* (ast: SchemaAST.Objects, field: string, seen: Ancestors) {
+	const entries: [PropertyKey, unknown][] = [];
+	for (const property of ast.propertySignatures) {
+		if (!property.type.context?.isOptional) {
+			entries.push([property.name, yield* wireMask(property.type, `${field}.${String(property.name)}`, seen)]);
+		}
+	}
+	return Object.fromEntries(entries);
+});
+const arrayMask = Effect.fnUntraced(function* (ast: SchemaAST.Arrays, field: string, seen: Ancestors) {
+	const items: unknown[] = [];
+	for (const [index, element] of ast.elements.entries()) {
+		if (!element.context?.isOptional) {
+			items.push(yield* wireMask(element, `${field}[${index}]`, seen));
+		}
+	}
+	return items;
+});
+const unionMask = Effect.fnUntraced(function* (ast: SchemaAST.Union, field: string, seen: Ancestors) {
+	for (const member of ast.types) {
+		const candidate = yield* Effect.result(wireMask(member, field, seen));
+		if (candidate._tag === "Success") {
+			return candidate.success;
+		}
+	}
+	return undefined;
+});
+function genericMask(ast: SchemaAST.AST, field: string, seen: Ancestors): Effect.Effect<unknown, InvalidRedactionMask> {
+	switch (ast._tag) {
+		case "String":
+		case "Unknown":
+		case "Any":
+			return Effect.succeed(REDACTED);
+		case "Number":
+			return Effect.succeed(0);
+		case "Boolean":
+			return Effect.succeed(false);
+		case "Null":
+			return Effect.succeed(null);
+		case "Undefined":
+		case "Void":
+			return Effect.succeed(undefined);
+		case "Literal":
+			return Effect.succeed(ast.literal);
+		case "Objects":
+			return objectMask(ast, field, seen);
+		case "Arrays":
+			return arrayMask(ast, field, seen);
+		case "Union":
+			return unionMask(ast, field, seen);
+		case "Suspend":
+			return wireMask(ast.thunk(), field, seen);
+		default:
+			return Effect.succeed(REDACTED);
+	}
+}
+
+export const wireMask = Effect.fnUntraced(function* (
+	ast: SchemaAST.AST,
+	field: string,
+	ancestors: Ancestors = new Set(),
+): Effect.fn.Return<unknown, InvalidRedactionMask> {
+	function invalid() {
+		return new InvalidRedactionMask({
+			field,
+			message: `Sensitive field "${field}" needs a schema-compatible mask; supply a redactionMask annotation on its wire schema.`,
+		});
+	}
+	if (ancestors.has(ast)) {
+		return yield* invalid();
+	}
+	const seen = new Set(ancestors).add(ast);
+	const Annotations = Schema.resolveAnnotations(Schema.make(ast));
+	let value: unknown;
+	if (Predicate.hasProperty(Annotations, "redactionMask")) {
+		value = Annotations.redactionMask;
+	} else {
+		value = ast.encoding === undefined ? yield* genericMask(ast, field, seen) : yield* wireMask(ast.encoding.at(-1)?.to ?? ast, field, seen);
+	}
+	if (Exit.isFailure(Schema.decodeUnknownExit(Schema.toCodecJson(Schema.make<Schema.Codec<unknown>>(ast)))(value))) {
+		return yield* invalid();
+	}
+	return value;
+});