@skillsmith/core 0.9.0 → 0.11.0

package/dist/src/logging/redact.d.ts

@@ -0,0 +1,35 @@
+/**
+ * SMI-883 / SMI-5615: Sensitive-data redaction, ported VERBATIM from the dead
+ * `packages/mcp-server/src/logger.ts` (lines 11-107) into the shared
+ * `@skillsmith/core` logging module. Same regex patterns, same behavior,
+ * same test coverage (see `redact.test.ts`) — this is tested, working code
+ * relocated, not rewritten.
+ */
+export declare function stripAnsi(text: string): string;
+/**
+ * SMI-883: Redact sensitive data from text before logging
+ * Exported for testing purposes
+ */
+export declare function redactSensitiveData(text: string): string;
+/**
+ * SMI-883: Recursively redact sensitive data from objects
+ * Exported for testing purposes
+ *
+ * SMI-5615 Mode-B diff-audit NEW-2: `seen` guards against circular
+ * references. The original (dead) `mcp-server/src/logger.ts` version this was
+ * ported from had no cycle guard — harmless there since it was never called
+ * in production, but this module IS the production write path now, so a
+ * circular `details`/`err` object (e.g. a thrown object with a `cause` cycle)
+ * must degrade to `'[Circular]'` rather than stack-overflowing, which would
+ * otherwise abort the whole record (including the redacted `msg` and
+ * `correlationId`) and fall through to the raw-message console fallback.
+ *
+ * `seen` tracks only the CURRENT recursion path (ancestors), not every object
+ * visited overall — each object is removed again once its own subtree
+ * finishes (the `finally` below). This is deliberate: the same object
+ * appearing twice at sibling positions (a shared, non-cyclic reference — a
+ * DAG, not a cycle) must redact normally both times, not get falsely flagged
+ * `'[Circular]'` just because it was visited once already elsewhere.
+ */
+export declare function redactSensitiveObject(obj: unknown, seen?: WeakSet<object>): unknown;
+//# sourceMappingURL=redact.d.ts.map

package/dist/src/logging/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../../src/logging/redact.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAqBH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG9C;AAmED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,IAAI,GAAE,OAAO,CAAC,MAAM,CAAiB,GACpC,OAAO,CAgBT"}

package/dist/src/logging/redact.js

@@ -0,0 +1,152 @@
+/**
+ * SMI-883 / SMI-5615: Sensitive-data redaction, ported VERBATIM from the dead
+ * `packages/mcp-server/src/logger.ts` (lines 11-107) into the shared
+ * `@skillsmith/core` logging module. Same regex patterns, same behavior,
+ * same test coverage (see `redact.test.ts`) — this is tested, working code
+ * relocated, not rewritten.
+ */
+/**
+ * Strips ANSI/SGR escape sequences (`\x1b[...m` — the `chalk`-style color
+ * codes CLI call sites wrap error text in). SMI-5615 Mode-B diff-audit
+ * (Wave 2 pass): the disk-persisted record must not embed raw escape codes
+ * as log noise, AND a secret sitting immediately after an escape code's
+ * trailing letter (e.g. `\x1b[31msk_live_...`) can defeat
+ * `redactSensitiveData`'s leading `\b` word-boundary check — the `m`→`s`
+ * transition is word-to-word, not a boundary. Stripping ANSI BEFORE redacting
+ * closes that gap. Only applied on the DISK-persisted path (`logger.ts`'s
+ * `buildRecord`/`normalizeError`) — deliberately NOT applied to the
+ * console-mirrored path, which must keep chalk's colors for CLI terminal UX.
+ * Covers chalk's actual output (SGR codes only); not a full ANSI/VT100 strip.
+ */
+// \x1b is the intentional ESC byte an SGR sequence always starts with; this
+// is the same pattern the widely-used `strip-ansi` npm package uses (also
+// eslint-disabled there).
+// eslint-disable-next-line no-control-regex
+const ANSI_SGR_PATTERN = /\x1b\[[0-9;]*m/g;
+export function stripAnsi(text) {
+    if (!text)
+        return text;
+    return text.replace(ANSI_SGR_PATTERN, '');
+}
+/**
+ * SMI-883: Sensitive data patterns to redact before logging
+ * Prevents API keys, tokens, passwords, and secrets from being written to disk
+ */
+const SENSITIVE_PATTERNS = [
+    // GitHub tokens
+    { pattern: /\b(ghp_[a-zA-Z0-9]{36})\b/g, replacement: 'ghp_[REDACTED]' },
+    { pattern: /\b(github_pat_[a-zA-Z0-9_]{22,})\b/g, replacement: 'github_pat_[REDACTED]' },
+    { pattern: /\b(gho_[a-zA-Z0-9]{36})\b/g, replacement: 'gho_[REDACTED]' },
+    { pattern: /\b(ghs_[a-zA-Z0-9]{36})\b/g, replacement: 'ghs_[REDACTED]' },
+    { pattern: /\b(ghu_[a-zA-Z0-9]{36})\b/g, replacement: 'ghu_[REDACTED]' },
+    { pattern: /\b(ghr_[a-zA-Z0-9]{36})\b/g, replacement: 'ghr_[REDACTED]' },
+    // Linear API keys
+    { pattern: /\b(lin_api_[a-zA-Z0-9]{32,})\b/g, replacement: 'lin_api_[REDACTED]' },
+    // Stripe keys
+    { pattern: /\b(sk_live_[a-zA-Z0-9]{24,})\b/g, replacement: 'sk_live_[REDACTED]' },
+    { pattern: /\b(sk_test_[a-zA-Z0-9]{24,})\b/g, replacement: 'sk_test_[REDACTED]' },
+    { pattern: /\b(pk_live_[a-zA-Z0-9]{24,})\b/g, replacement: 'pk_live_[REDACTED]' },
+    { pattern: /\b(pk_test_[a-zA-Z0-9]{24,})\b/g, replacement: 'pk_test_[REDACTED]' },
+    // OpenAI API keys
+    { pattern: /\b(sk-[a-zA-Z0-9]{48,})\b/g, replacement: 'sk-[REDACTED]' },
+    // Anthropic API keys
+    { pattern: /\b(sk-ant-[a-zA-Z0-9-]{32,})\b/g, replacement: 'sk-ant-[REDACTED]' },
+    // AWS keys
+    { pattern: /\b(AKIA[A-Z0-9]{16})\b/g, replacement: 'AKIA[REDACTED]' },
+    // Slack tokens
+    { pattern: /\b(xox[boaprs]-[a-zA-Z0-9-]{10,})\b/g, replacement: 'xox*-[REDACTED]' },
+    // npm tokens
+    { pattern: /\b(npm_[a-zA-Z0-9]{36})\b/g, replacement: 'npm_[REDACTED]' },
+    // Bearer tokens
+    { pattern: /\bBearer\s+([a-zA-Z0-9_\-.]{20,})/gi, replacement: 'Bearer [REDACTED]' },
+    // Basic auth
+    { pattern: /\bBasic\s+([a-zA-Z0-9+/=]{20,})/gi, replacement: 'Basic [REDACTED]' },
+    // JWT tokens
+    {
+        pattern: /\beyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]+\b/g,
+        replacement: '[JWT_REDACTED]',
+    },
+    // Generic API key patterns
+    {
+        pattern: /\b(api[_-]?key|apikey)\s*[=:]\s*["']?([a-zA-Z0-9_-]{8,})["']?/gi,
+        replacement: 'api_key=[REDACTED]',
+    },
+    {
+        pattern: /\b(token|auth[_-]?token)\s*[=:]\s*["']?([a-zA-Z0-9_-]{8,})["']?/gi,
+        replacement: 'token=[REDACTED]',
+    },
+    {
+        pattern: /\b(password|passwd|pwd)\s*[=:]\s*["']?([^"'\s]{4,})["']?/gi,
+        replacement: 'password=[REDACTED]',
+    },
+    {
+        pattern: /\b(secret|client[_-]?secret)\s*[=:]\s*["']?([a-zA-Z0-9_-]{8,})["']?/gi,
+        replacement: 'secret=[REDACTED]',
+    },
+    // Connection strings with passwords
+    { pattern: /(:\/\/[^:]+:)([^@]+)(@)/gi, replacement: '$1[REDACTED]$3' },
+    // Private keys
+    {
+        pattern: /-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----[\s\S]*?-----END\s+(RSA\s+)?PRIVATE\s+KEY-----/gi,
+        replacement: '-----[PRIVATE KEY REDACTED]-----',
+    },
+];
+/**
+ * SMI-883: Redact sensitive data from text before logging
+ * Exported for testing purposes
+ */
+export function redactSensitiveData(text) {
+    if (!text)
+        return text;
+    let redacted = text;
+    for (const { pattern, replacement } of SENSITIVE_PATTERNS) {
+        // Reset lastIndex for global regex patterns to ensure all matches are found
+        pattern.lastIndex = 0;
+        redacted = redacted.replace(pattern, replacement);
+    }
+    return redacted;
+}
+/**
+ * SMI-883: Recursively redact sensitive data from objects
+ * Exported for testing purposes
+ *
+ * SMI-5615 Mode-B diff-audit NEW-2: `seen` guards against circular
+ * references. The original (dead) `mcp-server/src/logger.ts` version this was
+ * ported from had no cycle guard — harmless there since it was never called
+ * in production, but this module IS the production write path now, so a
+ * circular `details`/`err` object (e.g. a thrown object with a `cause` cycle)
+ * must degrade to `'[Circular]'` rather than stack-overflowing, which would
+ * otherwise abort the whole record (including the redacted `msg` and
+ * `correlationId`) and fall through to the raw-message console fallback.
+ *
+ * `seen` tracks only the CURRENT recursion path (ancestors), not every object
+ * visited overall — each object is removed again once its own subtree
+ * finishes (the `finally` below). This is deliberate: the same object
+ * appearing twice at sibling positions (a shared, non-cyclic reference — a
+ * DAG, not a cycle) must redact normally both times, not get falsely flagged
+ * `'[Circular]'` just because it was visited once already elsewhere.
+ */
+export function redactSensitiveObject(obj, seen = new WeakSet()) {
+    if (obj === null || obj === undefined)
+        return obj;
+    if (typeof obj === 'string')
+        return redactSensitiveData(obj);
+    if (typeof obj !== 'object')
+        return obj;
+    if (seen.has(obj))
+        return '[Circular]';
+    seen.add(obj);
+    try {
+        if (Array.isArray(obj))
+            return obj.map((item) => redactSensitiveObject(item, seen));
+        const result = {};
+        for (const [key, value] of Object.entries(obj)) {
+            result[key] = redactSensitiveObject(value, seen);
+        }
+        return result;
+    }
+    finally {
+        seen.delete(obj);
+    }
+}
+//# sourceMappingURL=redact.js.map

package/dist/src/logging/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../../src/logging/redact.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;GAYG;AACH,4EAA4E;AAC5E,0EAA0E;AAC1E,0BAA0B;AAC1B,4CAA4C;AAC5C,MAAM,gBAAgB,GAAG,iBAAiB,CAAA;AAE1C,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAA;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,kBAAkB,GAAoD;IAC1E,gBAAgB;IAChB,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,gBAAgB,EAAE;IACxE,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,uBAAuB,EAAE;IACxF,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,gBAAgB,EAAE;IACxE,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,gBAAgB,EAAE;IACxE,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,gBAAgB,EAAE;IACxE,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,gBAAgB,EAAE;IACxE,kBAAkB;IAClB,EAAE,OAAO,EAAE,iCAAiC,EAAE,WAAW,EAAE,oBAAoB,EAAE;IACjF,cAAc;IACd,EAAE,OAAO,EAAE,iCAAiC,EAAE,WAAW,EAAE,oBAAoB,EAAE;IACjF,EAAE,OAAO,EAAE,iCAAiC,EAAE,WAAW,EAAE,oBAAoB,EAAE;IACjF,EAAE,OAAO,EAAE,iCAAiC,EAAE,WAAW,EAAE,oBAAoB,EAAE;IACjF,EAAE,OAAO,EAAE,iCAAiC,EAAE,WAAW,EAAE,oBAAoB,EAAE;IACjF,kBAAkB;IAClB,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,eAAe,EAAE;IACvE,qBAAqB;IACrB,EAAE,OAAO,EAAE,iCAAiC,EAAE,WAAW,EAAE,mBAAmB,EAAE;IAChF,WAAW;IACX,EAAE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,gBAAgB,EAAE;IACrE,eAAe;IACf,EAAE,OAAO,EAAE,sCAAsC,EAAE,WAAW,EAAE,iBAAiB,EAAE;IACnF,aAAa;IACb,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,gBAAgB,EAAE;IACxE,gBAAgB;IAChB,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACpF,aAAa;IACb,EAAE,OAAO,EAAE,mCAAmC,EAAE,WAAW,EAAE,kBAAkB,EAAE;IACjF,aAAa;IACb;QACE,OAAO,EAAE,2DAA2D;QACpE,WAAW,EAAE,gBAAgB;KAC9B;IACD,2BAA2B;IAC3B;QACE,OAAO,EAAE,iEAAiE;QAC1E,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,OAAO,EAAE,mEAAmE;QAC5E,WAAW,EAAE,kBAAkB;KAChC;IACD;QACE,OAAO,EAAE,4DAA4D;QACrE,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,OAAO,EAAE,uEAAuE;QAChF,WAAW,EAAE,mBAAmB;KACjC;IACD,oCAAoC;IACpC,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,gBAAgB,EAAE;IACvE,eAAe;IACf;QACE,OAAO,EACL,0FAA0F;QAC5F,WAAW,EAAE,kCAAkC;KAChD;CACF,CAAA;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,QAAQ,GAAG,IAAI,CAAA;IACnB,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,kBAAkB,EAAE,CAAC;QAC1D,4EAA4E;QAC5E,OAAO,CAAC,SAAS,GAAG,CAAC,CAAA;QACrB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACnD,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAY,EACZ,OAAwB,IAAI,OAAO,EAAE;IAErC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAA;IACjD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAA;IAC5D,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAA;IACvC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAA;IACtC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACb,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACnF,MAAM,MAAM,GAA4B,EAAE,CAAA;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAClD,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAClB,CAAC;AACH,CAAC"}

package/dist/src/logging/redact.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * SMI-883 / SMI-5615: Tests for logger sensitive data redaction, ported from
+ * `packages/mcp-server/tests/unit/logger.test.ts` — same coverage, new
+ * location (`@skillsmith/core`'s `logging/redact.ts`).
+ * Ensures API keys, tokens, passwords, and secrets are never written to disk.
+ */
+export {};
+//# sourceMappingURL=redact.test.d.ts.map

package/dist/src/logging/redact.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.test.d.ts","sourceRoot":"","sources":["../../../src/logging/redact.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/src/logging/redact.test.js

@@ -0,0 +1,330 @@
+/**
+ * SMI-883 / SMI-5615: Tests for logger sensitive data redaction, ported from
+ * `packages/mcp-server/tests/unit/logger.test.ts` — same coverage, new
+ * location (`@skillsmith/core`'s `logging/redact.ts`).
+ * Ensures API keys, tokens, passwords, and secrets are never written to disk.
+ */
+import { describe, it, expect } from 'vitest';
+import { redactSensitiveData, redactSensitiveObject, stripAnsi } from './redact.js';
+describe('SMI-883: Logger Sensitive Data Redaction', () => {
+    describe('redactSensitiveData', () => {
+        describe('GitHub tokens', () => {
+            it('should redact classic personal access tokens (ghp_)', () => {
+                const input = 'Token: ghp_1234567890abcdefghijklmnopqrstuvwxyz';
+                const result = redactSensitiveData(input);
+                expect(result).toBe('Token: ghp_[REDACTED]');
+                expect(result).not.toContain('1234567890');
+            });
+            it('should redact fine-grained personal access tokens (github_pat_)', () => {
+                const input = 'Using github_pat_abcdefghijklmnopqrstuvwx12345';
+                const result = redactSensitiveData(input);
+                expect(result).toBe('Using github_pat_[REDACTED]');
+            });
+            it('should redact OAuth tokens (gho_)', () => {
+                const input = 'OAuth: gho_1234567890abcdefghijklmnopqrstuvwxyz';
+                const result = redactSensitiveData(input);
+                expect(result).toBe('OAuth: gho_[REDACTED]');
+            });
+            it('should redact server-to-server tokens (ghs_)', () => {
+                const input = 'Server: ghs_1234567890abcdefghijklmnopqrstuvwxyz';
+                const result = redactSensitiveData(input);
+                expect(result).toBe('Server: ghs_[REDACTED]');
+            });
+            it('should redact user-to-server tokens (ghu_)', () => {
+                const input = 'User: ghu_1234567890abcdefghijklmnopqrstuvwxyz';
+                const result = redactSensitiveData(input);
+                expect(result).toBe('User: ghu_[REDACTED]');
+            });
+            it('should redact refresh tokens (ghr_)', () => {
+                const input = 'Refresh: ghr_1234567890abcdefghijklmnopqrstuvwxyz';
+                const result = redactSensitiveData(input);
+                expect(result).toBe('Refresh: ghr_[REDACTED]');
+            });
+        });
+        describe('Linear API keys', () => {
+            it('should redact Linear API keys (lin_api_)', () => {
+                const input = 'LINEAR_API_KEY=lin_api_abcdefghijklmnopqrstuvwxyz123456';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('lin_api_[REDACTED]');
+                expect(result).not.toContain('abcdefghij');
+            });
+        });
+        describe('Stripe keys', () => {
+            it('should redact live secret keys (sk_live_)', () => {
+                const input = 'STRIPE_KEY=sk_live_abcdefghijklmnopqrstuvwx';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('sk_live_[REDACTED]');
+            });
+            it('should redact test secret keys (sk_test_)', () => {
+                const input = 'STRIPE_KEY=sk_test_abcdefghijklmnopqrstuvwx';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('sk_test_[REDACTED]');
+            });
+            it('should redact live publishable keys (pk_live_)', () => {
+                const input = 'STRIPE_PK=pk_live_abcdefghijklmnopqrstuvwx';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('pk_live_[REDACTED]');
+            });
+            it('should redact test publishable keys (pk_test_)', () => {
+                const input = 'STRIPE_PK=pk_test_abcdefghijklmnopqrstuvwx';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('pk_test_[REDACTED]');
+            });
+        });
+        describe('OpenAI API keys', () => {
+            it('should redact OpenAI API keys (sk-)', () => {
+                const input = 'OPENAI_API_KEY=sk-abcdefghijklmnopqrstuvwxyz1234567890abcdefghijkl';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('sk-[REDACTED]');
+                expect(result).not.toContain('abcdefghij');
+            });
+        });
+        describe('Anthropic API keys', () => {
+            it('should redact Anthropic API keys (sk-ant-)', () => {
+                const input = 'ANTHROPIC_API_KEY=sk-ant-api03-abcdefghijklmnopqrstuvwxyz12';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('sk-ant-[REDACTED]');
+            });
+        });
+        describe('AWS keys', () => {
+            it('should redact AWS access key IDs (AKIA)', () => {
+                const input = 'AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('AKIA[REDACTED]');
+                expect(result).not.toContain('IOSFODNN7EXAMPLE');
+            });
+        });
+        describe('Slack tokens', () => {
+            it('should redact bot tokens (xoxb-)', () => {
+                const input = 'SLACK_TOKEN=xoxb-123456789012-1234567890123-abcdefghijklmnop';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('xox*-[REDACTED]');
+            });
+            it('should redact user tokens (xoxp-)', () => {
+                const input = 'SLACK_TOKEN=xoxp-123456789012-1234567890123-abcdefghijklmnop';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('xox*-[REDACTED]');
+            });
+        });
+        describe('npm tokens', () => {
+            it('should redact npm tokens (npm_)', () => {
+                const input = 'NPM_TOKEN=npm_abcdefghijklmnopqrstuvwxyz1234567890';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('npm_[REDACTED]');
+            });
+        });
+        describe('Bearer and Basic auth', () => {
+            it('should redact Bearer tokens', () => {
+                const input = 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('Bearer [REDACTED]');
+            });
+            it('should redact Basic auth credentials', () => {
+                const input = 'Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQxMjM0NTY=';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('Basic [REDACTED]');
+            });
+        });
+        describe('JWT tokens', () => {
+            it('should redact JWT tokens', () => {
+                const input = 'Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('[JWT_REDACTED]');
+                expect(result).not.toContain('eyJzdWI');
+            });
+        });
+        describe('Generic patterns', () => {
+            it('should redact api_key assignments', () => {
+                const input = 'config.api_key = "my_secret_api_key_12345"';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('api_key=[REDACTED]');
+            });
+            it('should redact password assignments', () => {
+                const input = 'password: "supersecret123"';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('password=[REDACTED]');
+            });
+            it('should redact secret assignments', () => {
+                const input = 'client_secret = "abcdefghijklmnop"';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('secret=[REDACTED]');
+            });
+            it('should redact token assignments', () => {
+                const input = 'auth_token: "my_auth_token_value"';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('token=[REDACTED]');
+            });
+        });
+        describe('Connection strings', () => {
+            it('should redact passwords in connection strings', () => {
+                const input = 'postgresql://user:mysecretpassword@localhost:5432/db';
+                const result = redactSensitiveData(input);
+                expect(result).toBe('postgresql://user:[REDACTED]@localhost:5432/db');
+                expect(result).not.toContain('mysecretpassword');
+            });
+            it('should redact passwords in MongoDB connection strings', () => {
+                const input = 'mongodb://admin:p4ssw0rd123@cluster.mongodb.net/mydb';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('[REDACTED]@cluster');
+                expect(result).not.toContain('p4ssw0rd123');
+            });
+        });
+        describe('Private keys', () => {
+            it('should redact RSA private keys', () => {
+                const input = `-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEA0Z3VS5JJcds3xfn/ygWyF8PbnGy
+-----END RSA PRIVATE KEY-----`;
+                const result = redactSensitiveData(input);
+                expect(result).toBe('-----[PRIVATE KEY REDACTED]-----');
+                expect(result).not.toContain('MIIEpAIBAAKCAQEA');
+            });
+            it('should redact generic private keys', () => {
+                const input = `-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEA
+-----END PRIVATE KEY-----`;
+                const result = redactSensitiveData(input);
+                expect(result).toBe('-----[PRIVATE KEY REDACTED]-----');
+            });
+        });
+        describe('Edge cases', () => {
+            it('should handle empty strings', () => {
+                expect(redactSensitiveData('')).toBe('');
+            });
+            it('should handle null-ish values', () => {
+                expect(redactSensitiveData(null)).toBe(null);
+                expect(redactSensitiveData(undefined)).toBe(undefined);
+            });
+            it('should handle text with no sensitive data', () => {
+                const input = 'This is a normal log message with no secrets';
+                expect(redactSensitiveData(input)).toBe(input);
+            });
+            it('should handle multiple tokens in same string', () => {
+                const input = 'GitHub: ghp_1234567890abcdefghijklmnopqrstuvwxyz, Stripe: sk_live_abcdefghijklmnopqrstuvwx';
+                const result = redactSensitiveData(input);
+                expect(result).toContain('ghp_[REDACTED]');
+                expect(result).toContain('sk_live_[REDACTED]');
+            });
+            it('should handle repeated calls (regex lastIndex reset)', () => {
+                const input = 'Token: ghp_1234567890abcdefghijklmnopqrstuvwxyz';
+                // Call multiple times to verify lastIndex is reset
+                const result1 = redactSensitiveData(input);
+                const result2 = redactSensitiveData(input);
+                const result3 = redactSensitiveData(input);
+                expect(result1).toBe('Token: ghp_[REDACTED]');
+                expect(result2).toBe('Token: ghp_[REDACTED]');
+                expect(result3).toBe('Token: ghp_[REDACTED]');
+            });
+        });
+    });
+    describe('redactSensitiveObject', () => {
+        it('should redact strings in simple objects', () => {
+            const input = {
+                token: 'ghp_1234567890abcdefghijklmnopqrstuvwxyz',
+                name: 'test',
+            };
+            const result = redactSensitiveObject(input);
+            expect(result.token).toBe('ghp_[REDACTED]');
+            expect(result.name).toBe('test');
+        });
+        it('should redact strings in nested objects', () => {
+            const input = {
+                config: {
+                    auth: {
+                        apiKey: 'sk_live_abcdefghijklmnopqrstuvwx',
+                    },
+                },
+            };
+            const result = redactSensitiveObject(input);
+            expect(result.config.auth).toEqual({
+                apiKey: 'sk_live_[REDACTED]',
+            });
+        });
+        it('should redact strings in arrays', () => {
+            const input = ['ghp_1234567890abcdefghijklmnopqrstuvwxyz', 'normal string'];
+            const result = redactSensitiveObject(input);
+            expect(result[0]).toBe('ghp_[REDACTED]');
+            expect(result[1]).toBe('normal string');
+        });
+        it('should handle mixed arrays and objects', () => {
+            const input = {
+                tokens: [
+                    { key: 'ghp_1234567890abcdefghijklmnopqrstuvwxyz' },
+                    { key: 'sk_live_abcdefghijklmnopqrstuvwx' },
+                ],
+            };
+            const result = redactSensitiveObject(input);
+            const tokens = result.tokens;
+            expect(tokens[0].key).toBe('ghp_[REDACTED]');
+            expect(tokens[1].key).toBe('sk_live_[REDACTED]');
+        });
+        it('should handle null and undefined', () => {
+            expect(redactSensitiveObject(null)).toBe(null);
+            expect(redactSensitiveObject(undefined)).toBe(undefined);
+        });
+        it('should preserve non-string primitives', () => {
+            const input = {
+                count: 42,
+                enabled: true,
+                ratio: 3.14,
+            };
+            const result = redactSensitiveObject(input);
+            expect(result).toEqual(input);
+        });
+        it('should handle Error objects by converting to plain object', () => {
+            const input = {
+                error: new Error('Failed with token ghp_1234567890abcdefghijklmnopqrstuvwxyz'),
+            };
+            const result = redactSensitiveObject(input);
+            // Error.message won't be in entries, but if serialized it would be redacted
+            expect(result.error).toBeDefined();
+        });
+        it('should mark a directly circular reference as [Circular] instead of stack-overflowing (SMI-5615 NEW-2)', () => {
+            const circular = { name: 'ghp_1234567890abcdefghijklmnopqrstuvwxyz' };
+            circular.self = circular;
+            const result = redactSensitiveObject(circular);
+            expect(result.name).toBe('ghp_[REDACTED]');
+            expect(result.self).toBe('[Circular]');
+        });
+        it('should mark an indirect (two-hop) circular reference as [Circular]', () => {
+            const a = {};
+            const b = { a };
+            a.b = b;
+            const result = redactSensitiveObject(a);
+            const nestedB = result.b;
+            expect(nestedB.a).toBe('[Circular]');
+        });
+        it('should NOT treat the same object appearing twice at sibling (non-cyclic) positions as circular', () => {
+            const shared = { key: 'ghp_1234567890abcdefghijklmnopqrstuvwxyz' };
+            const input = { first: shared, second: shared };
+            const result = redactSensitiveObject(input);
+            expect(result.first.key).toBe('ghp_[REDACTED]');
+            expect(result.second.key).toBe('ghp_[REDACTED]');
+        });
+    });
+    describe('stripAnsi (SMI-5615 Mode-B Wave 2 pass)', () => {
+        it('should strip chalk-style SGR color codes', () => {
+            const chalkRed = '\x1b[31mError:\x1b[39m something failed';
+            expect(stripAnsi(chalkRed)).toBe('Error: something failed');
+        });
+        it('should leave plain text with no escape codes untouched', () => {
+            expect(stripAnsi('plain text, no colors')).toBe('plain text, no colors');
+        });
+        it('should handle empty and null-ish input like redactSensitiveData does', () => {
+            expect(stripAnsi('')).toBe('');
+        });
+        it('closes the leading word-boundary redaction gap: a secret immediately after an SGR code is still redacted once ANSI is stripped first', () => {
+            // \x1b[31m ends in 'm' (a word char) directly followed by the secret's
+            // 's' (also a word char) — no \b between them, so redactSensitiveData
+            // alone would miss this. stripAnsi-then-redact is the fix (see
+            // `redactForDisk` in logger.ts).
+            const secret = 'sk_live_' + 'c'.repeat(24);
+            const chalkWrapped = `\x1b[31m${secret}\x1b[39m`;
+            // Demonstrates the gap exists when redacting the raw (un-stripped) text:
+            expect(redactSensitiveData(chalkWrapped)).toContain(secret);
+            // ...and that stripping ANSI first closes it:
+            expect(redactSensitiveData(stripAnsi(chalkWrapped))).not.toContain(secret);
+            expect(redactSensitiveData(stripAnsi(chalkWrapped))).toContain('sk_live_[REDACTED]');
+        });
+    });
+});
+//# sourceMappingURL=redact.test.js.map

package/dist/src/logging/redact.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.test.js","sourceRoot":"","sources":["../../../src/logging/redact.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEnF,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;YAC7B,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;gBAC7D,MAAM,KAAK,GAAG,iDAAiD,CAAA;gBAC/D,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;gBAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;gBACzE,MAAM,KAAK,GAAG,gDAAgD,CAAA;gBAC9D,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;YACpD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;gBAC3C,MAAM,KAAK,GAAG,iDAAiD,CAAA;gBAC/D,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;YAC9C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;gBACtD,MAAM,KAAK,GAAG,kDAAkD,CAAA;gBAChE,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;YAC/C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;gBACpD,MAAM,KAAK,GAAG,gDAAgD,CAAA;gBAC9D,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;gBAC7C,MAAM,KAAK,GAAG,mDAAmD,CAAA;gBACjE,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;YAChD,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;YAC/B,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;gBAClD,MAAM,KAAK,GAAG,yDAAyD,CAAA;gBACvE,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;gBAC9C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;YAC3B,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;gBACnD,MAAM,KAAK,GAAG,6CAA6C,CAAA;gBAC3D,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;YAChD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;gBACnD,MAAM,KAAK,GAAG,6CAA6C,CAAA;gBAC3D,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;YAChD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;gBACxD,MAAM,KAAK,GAAG,4CAA4C,CAAA;gBAC1D,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;YAChD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;gBACxD,MAAM,KAAK,GAAG,4CAA4C,CAAA;gBAC1D,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;YAChD,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;YAC/B,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;gBAC7C,MAAM,KAAK,GAAG,oEAAoE,CAAA;gBAClF,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAClC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;gBACpD,MAAM,KAAK,GAAG,6DAA6D,CAAA;gBAC3E,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAA;YAC/C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;YACxB,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;gBACjD,MAAM,KAAK,GAAG,wCAAwC,CAAA;gBACtD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;gBAC1C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;YAClD,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;YAC5B,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;gBAC1C,MAAM,KAAK,GAAG,8DAA8D,CAAA;gBAC5E,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;gBAC3C,MAAM,KAAK,GAAG,8DAA8D,CAAA;gBAC5E,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;YAC1B,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;gBACzC,MAAM,KAAK,GAAG,oDAAoD,CAAA;gBAClE,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;YAC5C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;YACrC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;gBACrC,MAAM,KAAK,GAAG,4DAA4D,CAAA;gBAC1E,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAA;YAC/C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;gBAC9C,MAAM,KAAK,GAAG,uDAAuD,CAAA;gBACrE,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;YAC9C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;YAC1B,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;gBAClC,MAAM,KAAK,GACT,oKAAoK,CAAA;gBACtK,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;gBAC1C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YACzC,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;YAChC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;gBAC3C,MAAM,KAAK,GAAG,4CAA4C,CAAA;gBAC1D,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;YAChD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;gBAC5C,MAAM,KAAK,GAAG,4BAA4B,CAAA;gBAC1C,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAA;YACjD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;gBAC1C,MAAM,KAAK,GAAG,oCAAoC,CAAA;gBAClD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAA;YAC/C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;gBACzC,MAAM,KAAK,GAAG,mCAAmC,CAAA;gBACjD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;YAC9C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAClC,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;gBACvD,MAAM,KAAK,GAAG,sDAAsD,CAAA;gBACpE,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAA;gBACrE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;YAClD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;gBAC/D,MAAM,KAAK,GAAG,sDAAsD,CAAA;gBACpE,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;gBAC9C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;YAC5B,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;gBACxC,MAAM,KAAK,GAAG;;8BAEQ,CAAA;gBACtB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;gBACvD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;YAClD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;gBAC5C,MAAM,KAAK,GAAG;;0BAEI,CAAA;gBAClB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;YACzD,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;YAC1B,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;gBACrC,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC1C,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;gBACvC,MAAM,CAAC,mBAAmB,CAAC,IAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACjE,MAAM,CAAC,mBAAmB,CAAC,SAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAC7E,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;gBACnD,MAAM,KAAK,GAAG,8CAA8C,CAAA;gBAC5D,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAChD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;gBACtD,MAAM,KAAK,GACT,4FAA4F,CAAA;gBAC9F,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;gBAC1C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;YAChD,CAAC,CAAC,CAAA;YAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;gBAC9D,MAAM,KAAK,GAAG,iDAAiD,CAAA;gBAC/D,mDAAmD;gBACnD,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBAC1C,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBAC1C,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;gBAC1C,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;gBAC7C,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;gBAC7C,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;YAC/C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,KAAK,GAAG;gBACZ,KAAK,EAAE,0CAA0C;gBACjD,IAAI,EAAE,MAAM;aACb,CAAA;YACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAA4B,CAAA;YACtE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;YAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAClC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,KAAK,GAAG;gBACZ,MAAM,EAAE;oBACN,IAAI,EAAE;wBACJ,MAAM,EAAE,kCAAkC;qBAC3C;iBACF;aACF,CAAA;YACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAA4B,CAAA;YACtE,MAAM,CAAE,MAAM,CAAC,MAAkC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;gBAC9D,MAAM,EAAE,oBAAoB;aAC7B,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,KAAK,GAAG,CAAC,0CAA0C,EAAE,eAAe,CAAC,CAAA;YAC3E,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAa,CAAA;YACvD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;YACxC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACzC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,KAAK,GAAG;gBACZ,MAAM,EAAE;oBACN,EAAE,GAAG,EAAE,0CAA0C,EAAE;oBACnD,EAAE,GAAG,EAAE,kCAAkC,EAAE;iBAC5C;aACF,CAAA;YACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAA4B,CAAA;YACtE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAwC,CAAA;YAC9D,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;YAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9C,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC1D,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,KAAK,GAAG;gBACZ,KAAK,EAAE,EAAE;gBACT,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,IAAI;aACZ,CAAA;YACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;YAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/B,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,KAAK,GAAG;gBACZ,KAAK,EAAE,IAAI,KAAK,CAAC,4DAA4D,CAAC;aAC/E,CAAA;YACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAA4B,CAAA;YACtE,4EAA4E;YAC5E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;QACpC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uGAAuG,EAAE,GAAG,EAAE;YAC/G,MAAM,QAAQ,GAA4B,EAAE,IAAI,EAAE,0CAA0C,EAAE,CAAA;YAC9F,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAA;YACxB,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAA4B,CAAA;YACzE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;YAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACxC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;YAC5E,MAAM,CAAC,GAA4B,EAAE,CAAA;YACrC,MAAM,CAAC,GAA4B,EAAE,CAAC,EAAE,CAAA;YACxC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACP,MAAM,MAAM,GAAG,qBAAqB,CAAC,CAAC,CAA4B,CAAA;YAClE,MAAM,OAAO,GAAG,MAAM,CAAC,CAA4B,CAAA;YACnD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACtC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,gGAAgG,EAAE,GAAG,EAAE;YACxG,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,0CAA0C,EAAE,CAAA;YAClE,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;YAC/C,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAA4B,CAAA;YACtE,MAAM,CAAE,MAAM,CAAC,KAAiC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;YAC5E,MAAM,CAAE,MAAM,CAAC,MAAkC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC/E,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACvD,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,QAAQ,GAAG,yCAAyC,CAAA;YAC1D,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;QAC7D,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QAC1E,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;YAC9E,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAChC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,sIAAsI,EAAE,GAAG,EAAE;YAC9I,uEAAuE;YACvE,sEAAsE;YACtE,+DAA+D;YAC/D,iCAAiC;YACjC,MAAM,MAAM,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAC1C,MAAM,YAAY,GAAG,WAAW,MAAM,UAAU,CAAA;YAEhD,yEAAyE;YACzE,MAAM,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YAE3D,8CAA8C;YAC9C,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YAC1E,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;QACtF,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/logging/rotation.d.ts

@@ -0,0 +1,75 @@
+/**
+ * SMI-5615: Per-surface serialized JSONL writer with daily/size rollover and
+ * retention sweep.
+ *
+ * Write-serialization invariant (F2, from
+ * docs/internal/implementation/production-error-logging.md — the plan's
+ * original P-5 draft omitted this; it was the Opus `concurrency-auditor`
+ * plan-audit's most likely real-world race):
+ *
+ *   A redacted error record (stack ≤20 frames) can exceed `PIPE_BUF`
+ *   (4096 bytes), so concurrent, independent `appendFile`/`appendFileSync`
+ *   calls from parallel async tool invocations are NOT safe here — two
+ *   large concurrent writes can interleave/tear into one invalid JSONL line.
+ *
+ *   Fix: one long-lived `fs.createWriteStream(path, { flags: 'a' })` per
+ *   surface, created lazily on first write and cached in a module-scoped
+ *   map. ALL writes for a given surface go through THIS single stream.
+ *
+ *   That alone (Node serializing writes queued on one stream) would already
+ *   prevent tearing between two writes to the SAME stream object. This
+ *   module goes one step further for simplicity and an even stronger
+ *   guarantee: every write is wrapped in an async mutex (`runExclusive`) keyed
+ *   by surface, so at most one write is ever in flight to a surface's
+ *   underlying file descriptor at a time — including the write that decides
+ *   whether a daily/size rollover is needed. That decision-and-possible-swap
+ *   (open a new stream, `end()` the old one) happens INSIDE the same
+ *   exclusive section as the write that triggered it, so a rotation can
+ *   never race a write: no write can land on a stream that has already been
+ *   told to `end()`, and no two writers can simultaneously decide "today's
+ *   file doesn't exist yet" and both create a stream.
+ *
+ * Daily rollover: `skillsmith-<surface>-<YYYY-MM-DD>.jsonl`, keyed off the
+ * calendar date at write time (mocked by `vi.setSystemTime` in tests — no
+ * separate clock seam needed).
+ *
+ * Size cap: ~10MB per file. When the currently-open file for TODAY would
+ * exceed the cap, roll to a `.1`/`.2`/... suffixed continuation file for the
+ * same day (`skillsmith-<surface>-<YYYY-MM-DD>.jsonl.<n>`), through the same
+ * serialization point as everything else.
+ *
+ * Retention: on module init, asynchronously (NOT awaited — never blocks
+ * import) sweep `~/.skillsmith/logs/` and delete files whose mtime is older
+ * than 14 days. `pruneExpiredLogs` is also exported directly so tests can
+ * await a deterministic run against a temp directory instead of racing the
+ * fire-and-forget module-init sweep.
+ */
+import type { Surface } from './types.js';
+/**
+ * Serializes `line` for `surface`: acquires that surface's exclusive queue,
+ * resolves (opening/rotating as needed) the current stream, and writes.
+ * Resolves once the OS-level write has completed; rejects (never throws
+ * synchronously) if the directory/file couldn't be created or the write
+ * failed — callers (see `logger.ts`) must handle rejection to honor the
+ * "logger never throws" invariant.
+ */
+export declare function writeLogLine(surface: Surface, line: string): Promise<void>;
+/**
+ * Deletes files under the log directory whose mtime is older than
+ * `RETENTION_DAYS`. Best-effort: a missing directory or a per-file stat/
+ * unlink failure (permissions, a concurrent process already deleted it,
+ * etc.) is swallowed rather than thrown — this must never be able to crash
+ * module init or take down a caller that awaits it in a test.
+ *
+ * Exported (not just fired at module init) so tests can await a
+ * deterministic run against a temp directory rather than racing the
+ * fire-and-forget call below.
+ */
+export declare function pruneExpiredLogs(): Promise<void>;
+/**
+ * Closes any open streams and clears all in-memory state. Test-only — used
+ * by `rotation.test.ts` between cases so state from one temp-dir scenario
+ * never leaks into the next.
+ */
+export declare function __resetLoggingStateForTests(): Promise<void>;
+//# sourceMappingURL=rotation.d.ts.map

package/dist/src/logging/rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../../../src/logging/rotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAqLzC;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO1E;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAsBtD;AAkBD;;;;GAIG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC,CAQjE"}