@smthrs/journal 0.0.0-stage → 1.0.0-rc.3

package/dist/cjs/Migrations.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Journal schema migrations.
+ *
+ * The journal owns four tables: `flows_journal_events` and its event-type
+ * index in `0001_initial`, `flows_journal_checkpoints` in
+ * `0002_checkpoints`, the bounded startup ordering index in
+ * `0003_startup_index`, compacted producer identities in `0004_dedup`, the
+ * per-run exact event-type cursor index in `0005_run_event_type`, and the
+ * `SqlConsensus` lease table `flows_consensus_leases` in `0006_consensus`. Run
+ * and attempt state migrate from `@smthrs/run-store`, the step cache from
+ * `@smthrs/step-cache`, and the durable deferred/clock tables from
+ * `@smthrs/engine-store`; an application composes those sets with this one
+ * through `@smthrs/database`'s `Migrations.layer`.
+ *
+ * @since 0.1.0
+ */
+import * as DatabaseMigrations from "@smthrs/database/Migrations";
+import * as Layer from "effect/Layer";
+/**
+ * The journal's namespaced migration set, for composition with the other
+ * storage packages.
+ *
+ * @category migrations
+ * @since 0.1.0
+ */
+export declare const set: DatabaseMigrations.MigrationSet;
+/**
+ * Creates the journal's authoritative durable schema.
+ *
+ * @category migrations
+ * @since 0.1.0
+ */
+export declare const run: import("effect/Effect").Effect<readonly (readonly [id: number, name: string])[], import("effect/unstable/sql/SqlError").SqlError | import("effect/unstable/sql/Migrator").MigrationError, import("effect/unstable/sql/SqlClient").SqlClient>;
+/**
+ * Layer that runs journal migrations before exposing the database to journal
+ * services.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layer: Layer.Layer<never, import("effect/unstable/sql/SqlError").SqlError | import("effect/unstable/sql/Migrator").MigrationError, import("effect/unstable/sql/SqlClient").SqlClient>;
+//# sourceMappingURL=Migrations.d.ts.map

package/dist/cjs/Migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migrations.d.ts","sourceRoot":"","sources":["../../src/Migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,kBAAkB,MAAM,6BAA6B,CAAA;AACjE,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAQrC;;;;;;GAMG;AACH,eAAO,MAAM,GAAG,EAAE,kBAAkB,CAAC,YAWpC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,GAAG,8OAAgC,CAAA;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,gLAA2B,CAAA"}

package/dist/cjs/Migrations.js

@@ -0,0 +1,58 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var Migrations_exports = {};
+__export(Migrations_exports, {
+  layer: () => layer,
+  run: () => run,
+  set: () => set
+});
+module.exports = __toCommonJS(Migrations_exports);
+var DatabaseMigrations = __toESM(require("@smthrs/database/Migrations"), 1);
+var Layer = __toESM(require("effect/Layer"), 1);
+var import_initial = require("./migrations/0001_initial.js");
+var import_checkpoints = require("./migrations/0002_checkpoints.js");
+var import_startup_index = require("./migrations/0003_startup_index.js");
+var import_dedup = require("./migrations/0004_dedup.js");
+var import_run_event_type = require("./migrations/0005_run_event_type.js");
+var import_consensus = require("./migrations/0006_consensus.js");
+const set = {
+  namespace: "journal",
+  idOffset: 0,
+  migrations: {
+    "0001_initial": import_initial.initial,
+    "0002_checkpoints": import_checkpoints.checkpoints,
+    "0003_startup_index": import_startup_index.startupIndex,
+    "0004_dedup": import_dedup.dedup,
+    "0005_run_event_type": import_run_event_type.runEventType,
+    "0006_consensus": import_consensus.consensus
+  }
+};
+const run = DatabaseMigrations.run([set]);
+const layer = Layer.effectDiscard(run);
+//# sourceMappingURL=Migrations.js.map

package/dist/cjs/Migrations.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/Migrations.ts"],
+  "sourcesContent": ["/**\n * Journal schema migrations.\n *\n * The journal owns four tables: `flows_journal_events` and its event-type\n * index in `0001_initial`, `flows_journal_checkpoints` in\n * `0002_checkpoints`, the bounded startup ordering index in\n * `0003_startup_index`, compacted producer identities in `0004_dedup`, the\n * per-run exact event-type cursor index in `0005_run_event_type`, and the\n * `SqlConsensus` lease table `flows_consensus_leases` in `0006_consensus`. Run\n * and attempt state migrate from `@smthrs/run-store`, the step cache from\n * `@smthrs/step-cache`, and the durable deferred/clock tables from\n * `@smthrs/engine-store`; an application composes those sets with this one\n * through `@smthrs/database`'s `Migrations.layer`.\n *\n * @since 0.1.0\n */\n\nimport * as DatabaseMigrations from \"@smthrs/database/Migrations\"\nimport * as Layer from \"effect/Layer\"\nimport { initial } from \"./migrations/0001_initial.ts\"\nimport { checkpoints } from \"./migrations/0002_checkpoints.ts\"\nimport { startupIndex } from \"./migrations/0003_startup_index.ts\"\nimport { dedup } from \"./migrations/0004_dedup.ts\"\nimport { runEventType } from \"./migrations/0005_run_event_type.ts\"\nimport { consensus } from \"./migrations/0006_consensus.ts\"\n\n/**\n * The journal's namespaced migration set, for composition with the other\n * storage packages.\n *\n * @category migrations\n * @since 0.1.0\n */\nexport const set: DatabaseMigrations.MigrationSet = {\n  namespace: \"journal\",\n  idOffset: 0,\n  migrations: {\n    \"0001_initial\": initial,\n    \"0002_checkpoints\": checkpoints,\n    \"0003_startup_index\": startupIndex,\n    \"0004_dedup\": dedup,\n    \"0005_run_event_type\": runEventType,\n    \"0006_consensus\": consensus\n  }\n}\n\n/**\n * Creates the journal's authoritative durable schema.\n *\n * @category migrations\n * @since 0.1.0\n */\nexport const run = DatabaseMigrations.run([set])\n\n/**\n * Layer that runs journal migrations before exposing the database to journal\n * services.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layer = Layer.effectDiscard(run)\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBA,yBAAoC;AACpC,YAAuB;AACvB,qBAAwB;AACxB,yBAA4B;AAC5B,2BAA6B;AAC7B,mBAAsB;AACtB,4BAA6B;AAC7B,uBAA0B;AASnB,MAAM,MAAuC;AAAA,EAClD,WAAW;AAAA,EACX,UAAU;AAAA,EACV,YAAY;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,IACpB,sBAAsB;AAAA,IACtB,cAAc;AAAA,IACd,uBAAuB;AAAA,IACvB,kBAAkB;AAAA,EACpB;AACF;AAQO,MAAM,MAAM,mBAAmB,IAAI,CAAC,GAAG,CAAC;AASxC,MAAM,QAAQ,MAAM,cAAc,GAAG;",
+  "names": []
+}

package/dist/cjs/OwnerId.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The fencing token the journal accepts on durable appends.
+ *
+ * `OwnerId` lives here rather than with the ownership *arbitration* in
+ * `@smthrs/run-store` because the journal is what it fences: `emitDurable`
+ * takes an owner and refuses the append when the persisted fence has moved on.
+ * The journal therefore defines the token, and the run store (which stores it
+ * on runs and arbitrates who holds it) imports it.
+ *
+ * @since 0.1.0
+ */
+import * as Schema from "effect/Schema";
+/**
+ * A process identity scoped to a host and a unique ownership nonce.
+ *
+ * `pid` is a real operating-system process id, so the schema states that: a
+ * non-negative integer. A fractional, `NaN`, or negative `pid` is a caller
+ * bug, and the fenced methods reject it as `invalid_event` rather than
+ * degrading it into `fence_lost`, which would read as "someone else owns this
+ * run" and send the caller looking for a race that never happened.
+ *
+ * `hostId` and `nonce` stay plain strings. An empty one is a legal value that
+ * simply matches no persisted owner, which is exactly `fence_lost`.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export declare const OwnerId: Schema.Struct<{
+    readonly hostId: Schema.String;
+    readonly pid: Schema.Int;
+    readonly nonce: Schema.String;
+}>;
+/**
+ * A process identity scoped to a host and a unique ownership nonce.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export type OwnerId = typeof OwnerId.Type;
+//# sourceMappingURL=OwnerId.d.ts.map

package/dist/cjs/OwnerId.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OwnerId.d.ts","sourceRoot":"","sources":["../../src/OwnerId.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,OAAO;;;;EAIlB,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,IAAI,CAAA"}

package/dist/cjs/OwnerId.js

@@ -0,0 +1,40 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var OwnerId_exports = {};
+__export(OwnerId_exports, {
+  OwnerId: () => OwnerId
+});
+module.exports = __toCommonJS(OwnerId_exports);
+var Schema = __toESM(require("effect/Schema"), 1);
+const OwnerId = Schema.Struct({
+  hostId: Schema.String,
+  pid: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+  nonce: Schema.String
+});
+//# sourceMappingURL=OwnerId.js.map

package/dist/cjs/OwnerId.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/OwnerId.ts"],
+  "sourcesContent": ["/**\n * The fencing token the journal accepts on durable appends.\n *\n * `OwnerId` lives here rather than with the ownership *arbitration* in\n * `@smthrs/run-store` because the journal is what it fences: `emitDurable`\n * takes an owner and refuses the append when the persisted fence has moved on.\n * The journal therefore defines the token, and the run store (which stores it\n * on runs and arbitrates who holds it) imports it.\n *\n * @since 0.1.0\n */\n\nimport * as Schema from \"effect/Schema\"\n\n/**\n * A process identity scoped to a host and a unique ownership nonce.\n *\n * `pid` is a real operating-system process id, so the schema states that: a\n * non-negative integer. A fractional, `NaN`, or negative `pid` is a caller\n * bug, and the fenced methods reject it as `invalid_event` rather than\n * degrading it into `fence_lost`, which would read as \"someone else owns this\n * run\" and send the caller looking for a race that never happened.\n *\n * `hostId` and `nonce` stay plain strings. An empty one is a legal value that\n * simply matches no persisted owner, which is exactly `fence_lost`.\n *\n * @since 0.1.0\n * @category models\n */\nexport const OwnerId = Schema.Struct({\n  hostId: Schema.String,\n  pid: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  nonce: Schema.String\n})\n\n/**\n * A process identity scoped to a host and a unique ownership nonce.\n *\n * @since 0.1.0\n * @category models\n */\nexport type OwnerId = typeof OwnerId.Type\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,aAAwB;AAiBjB,MAAM,UAAU,OAAO,OAAO;AAAA,EACnC,QAAQ,OAAO;AAAA,EACf,KAAK,OAAO,IAAI,MAAM,OAAO,uBAAuB,CAAC,CAAC;AAAA,EACtD,OAAO,OAAO;AAChB,CAAC;",
+  "names": []
+}

package/dist/cjs/Projection.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Reproducible journal projections.
+ *
+ * @since 0.1.0
+ */
+import type * as Effect from "effect/Effect";
+import type { Entry } from "./JournalEvent.ts";
+/**
+ * An effectful fold over committed journal entries.
+ *
+ * Projections have no independent durable state. Replaying the same entries
+ * through the same reducer must reproduce the same result.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Projection<S, E = never, R = never> {
+    readonly name: string;
+    readonly initial: S;
+    readonly reduce: (state: S, entry: Entry) => Effect.Effect<S, E, R>;
+}
+/**
+ * Constructs a reproducible journal projection.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export declare const make: <S, E = never, R = never>(projection: Projection<S, E, R>) => Projection<S, E, R>;
+//# sourceMappingURL=Projection.d.ts.map

package/dist/cjs/Projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Projection.d.ts","sourceRoot":"","sources":["../../src/Projection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAA;AAC5C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAE9C;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;CACpE;AAED;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,YAAY,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAe,CAAA"}

package/dist/cjs/Projection.js

@@ -0,0 +1,25 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var Projection_exports = {};
+__export(Projection_exports, {
+  make: () => make
+});
+module.exports = __toCommonJS(Projection_exports);
+const make = (projection) => projection;
+//# sourceMappingURL=Projection.js.map

package/dist/cjs/Projection.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/Projection.ts"],
+  "sourcesContent": ["/**\n * Reproducible journal projections.\n *\n * @since 0.1.0\n */\n\nimport type * as Effect from \"effect/Effect\"\nimport type { Entry } from \"./JournalEvent.ts\"\n\n/**\n * An effectful fold over committed journal entries.\n *\n * Projections have no independent durable state. Replaying the same entries\n * through the same reducer must reproduce the same result.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Projection<S, E = never, R = never> {\n  readonly name: string\n  readonly initial: S\n  readonly reduce: (state: S, entry: Entry) => Effect.Effect<S, E, R>\n}\n\n/**\n * Constructs a reproducible journal projection.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const make = <S, E = never, R = never>(projection: Projection<S, E, R>): Projection<S, E, R> => projection\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA8BO,MAAM,OAAO,CAA0B,eAAyD;",
+  "names": []
+}

package/dist/cjs/RedactedLogger.d.ts

@@ -0,0 +1,121 @@
+/**
+ * The redacting logger: the journal's redaction rules applied to log output.
+ *
+ * The journal redacts on the write path, so a credential a cell logs or
+ * returns never reaches a committed row (`./Redaction.ts`). The operator's
+ * terminal was the other place the same credential surfaces: every built-in
+ * Effect logger renders through the fiber's `Console`, so an action that hands
+ * a token to `Effect.logInfo` wrote it to stderr in full and it reached
+ * whatever collected that stream.
+ *
+ * This module closes that half with the SAME rules rather than a second rule
+ * set. {@link wrap} does not re-implement redaction and does not re-format a
+ * log line. It redacts the log event itself — the message, the cause, and the
+ * log annotations — before the wrapped logger is handed it, and it hands that
+ * logger a view of the fiber whose `Console` is a redacting console, so
+ * whatever the logger renders for itself — a pretty line, a JSON document —
+ * passes through `Redaction.redact` on its way to the stream as well.
+ *
+ * Both halves carry load. Most built-in loggers write through the fiber's
+ * `Console`, which is what covers the pretty line, the `--json` document, and
+ * the `.flows/logs/<runId>.log` stream. But a logger is free to read the event
+ * instead of rendering it, and one in Effect's own default logger set does:
+ * `Logger.tracerLogger` publishes the message as a span event name and
+ * `Cause.pretty` of the cause as the span's `effect.cause` attribute, and
+ * never reads `Console` at all. Redacting only the console would hide a
+ * credential on stderr and export it in clear to whatever OTLP collector is
+ * configured.
+ *
+ * Cost is bounded by the rules themselves: every alternation inside a
+ * repetition in `Redaction.diagnosticRules` starts its branches with disjoint
+ * characters, so each rule is linear in the length of the line and no input
+ * backtracks catastrophically.
+ *
+ * One deliberate difference from the journal write path. `Redaction.redact`
+ * rebuilds an object from its own enumerable entries, which is right for a row
+ * that is about to be JSON-encoded and wrong for a terminal: an `Error` keeps
+ * `message` and `stack` on non-enumerable properties, so rebuilding one prints
+ * `{}` where the operator expected a failure. An `Error` is rebuilt as a plain
+ * `Error` instead, carrying its name, message, stack and own members with the
+ * rules applied. Its class is NOT preserved. A copy built on the original's
+ * prototype inherits everything the prototype defines, an own-key walk sees
+ * none of it, and each of `name`, `cause`, `toJSON`, `Symbol.toStringTag` and
+ * `nodejs.util.inspect.custom` carried a credential out that way.
+ *
+ * @since 0.1.0
+ */
+import * as Console from "effect/Console";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Redaction from "./Redaction.ts";
+/**
+ * Marks a logger this module already wrapped.
+ *
+ * Both the CLI and the durable runtime install {@link layer}, and a detached
+ * `smithers run` is both at once. Wrapping twice would be correct but pay the
+ * rules twice per line, so a wrapped logger is returned unchanged.
+ *
+ * @since 0.1.0
+ * @category type ids
+ */
+export declare const TypeId: unique symbol;
+/**
+ * Whether {@link wrap} already wrapped this logger.
+ *
+ * @since 0.1.0
+ * @category predicates
+ */
+export declare const isRedacted: (logger: Logger.Logger<any, any>) => boolean;
+/**
+ * Redacts one value on its way out of the logger.
+ *
+ * An `Error` is rebuilt as a plain `Error` whose name, message, stack and own
+ * members are redacted, so a renderer that special-cases an `Error` still gets
+ * one. Everything else goes through the journal's own rules, which rebuild a
+ * value from its plain data: a `Date`, a `Map`, a class instance or a host
+ * object therefore reaches the operator in that plain form rather than as
+ * itself.
+ *
+ * That collapse is deliberate, and it now covers the `Error` too. An earlier
+ * version rebuilt each value on its own prototype to keep the rendering
+ * faithful. Three rounds of review found three ways that could kill the run it
+ * was logging, because a host class keeps state a property walk cannot see and
+ * a copy of one throws the moment a brand check reads it, and four more found
+ * that the prototype an `Error` copy kept was itself the leak: everything it
+ * defines is read by a renderer and seen by no own-key walk. A log line is not
+ * worth a run, and the rendering it buys is cosmetic.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+export declare const redactArgument: (value: unknown, redactor: Redaction.Redactor) => unknown;
+/**
+ * A console that runs every value it is handed through `redactor` and then
+ * delegates to `target`.
+ *
+ * @since 0.1.0
+ * @category constructors
+ */
+export declare const redactingConsole: (target: Console.Console, redactor: Redaction.Redactor) => Console.Console;
+/**
+ * Returns `logger` with the journal's redaction rules over everything it
+ * renders. A logger this module already wrapped is returned unchanged.
+ *
+ * @since 0.1.0
+ * @category combinators
+ */
+export declare const wrap: <Message, Output>(logger: Logger.Logger<Message, Output>, options?: Redaction.Options) => Logger.Logger<Message, Output>;
+/**
+ * Replaces the active logger set with redacting wrappers of the same loggers.
+ *
+ * It composes over whatever loggers are already installed rather than
+ * choosing one, so an operator keeps the FORMAT they had, meaning their own
+ * logger and its layout, though a value inside a line is rendered from its
+ * redacted plain data rather than as its own class, and a host that
+ * installed its own logger keeps it too.
+ *
+ * @since 0.1.0
+ * @category layers
+ */
+export declare const layer: (options?: Redaction.Options) => Layer.Layer<never>;
+//# sourceMappingURL=RedactedLogger.d.ts.map

package/dist/cjs/RedactedLogger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RedactedLogger.d.ts","sourceRoot":"","sources":["../../src/RedactedLogger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAGH,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AAIzC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAE3C;;;;;;;;;GASG;AACH,eAAO,MAAM,MAAM,EAAE,OAAO,MAAqD,CAAA;AAEjF;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,QAAQ,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,KAAG,OAA2B,CAAA;AA2LxF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,OAAO,EAAE,UAAU,SAAS,CAAC,QAAQ,KAAG,OAW7E,CAAA;AAKD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,OAAO,CAAC,OAAO,EAAE,UAAU,SAAS,CAAC,QAAQ,KAAG,OAAO,CAAC,OA0BhG,CAAA;AAkFD;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,GAAI,OAAO,EAAE,MAAM,EAClC,QAAQ,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EACtC,UAAU,SAAS,CAAC,OAAO,KAC1B,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAiC/B,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,KAAK,GAAI,UAAU,SAAS,CAAC,OAAO,KAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAUlE,CAAA"}

package/dist/cjs/RedactedLogger.js

@@ -0,0 +1,235 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var RedactedLogger_exports = {};
+__export(RedactedLogger_exports, {
+  TypeId: () => TypeId,
+  isRedacted: () => isRedacted,
+  layer: () => layer,
+  redactArgument: () => redactArgument,
+  redactingConsole: () => redactingConsole,
+  wrap: () => wrap
+});
+module.exports = __toCommonJS(RedactedLogger_exports);
+var Cause = __toESM(require("effect/Cause"), 1);
+var Console = __toESM(require("effect/Console"), 1);
+var Context = __toESM(require("effect/Context"), 1);
+var Effect = __toESM(require("effect/Effect"), 1);
+var Layer = __toESM(require("effect/Layer"), 1);
+var Logger = __toESM(require("effect/Logger"), 1);
+var References = __toESM(require("effect/References"), 1);
+var Redaction = __toESM(require("./Redaction.js"), 1);
+const TypeId = /* @__PURE__ */ Symbol.for("@smthrs/journal/RedactedLogger");
+const isRedacted = (logger) => TypeId in logger;
+const consoleMethods = {
+  assert: true,
+  clear: false,
+  count: true,
+  countReset: true,
+  debug: true,
+  dir: true,
+  dirxml: true,
+  error: true,
+  group: true,
+  groupCollapsed: true,
+  groupEnd: false,
+  info: true,
+  log: true,
+  table: true,
+  time: true,
+  timeEnd: true,
+  timeLog: true,
+  trace: true,
+  warn: true
+};
+const renderDepthLimit = 200;
+const renderDepthMarker = "[Deep]";
+const toArray = (message) => Array.isArray(message) ? message : [message];
+const redactedText = (read, redactor, fallback) => {
+  try {
+    return String(redactor(String(read())));
+  } catch {
+    return fallback;
+  }
+};
+const redactedStack = (error, redactor) => {
+  try {
+    const stack = error.stack;
+    return typeof stack === "string" ? String(redactor(stack)) : void 0;
+  } catch {
+    return void 0;
+  }
+};
+const redactedName = (key, redactor) => {
+  const redacted = String(redactor(key));
+  return redacted === key ? key : Redaction.placeholder;
+};
+const renderHooks = /* @__PURE__ */ new Set([
+  "constructor",
+  "message",
+  "name",
+  "stack",
+  "toJSON",
+  "toString",
+  "valueOf"
+]);
+const redactError = (error, redactor, seen, depth = 0) => {
+  const memoized = seen.get(error);
+  if (memoized !== void 0) return memoized;
+  const clone = new Error();
+  seen.set(error, clone);
+  const define = (key, value, enumerable) => {
+    Object.defineProperty(clone, key, { value, writable: true, enumerable, configurable: true });
+  };
+  define("name", redactedText(() => error.name, redactor, "Error"), false);
+  define("message", redactedText(() => error.message, redactor, ""), false);
+  define("stack", redactedStack(error, redactor), false);
+  for (const key of Object.getOwnPropertyNames(error)) {
+    if (renderHooks.has(key)) continue;
+    const descriptor = Object.getOwnPropertyDescriptor(error, key);
+    const value = "value" in descriptor ? descriptor.value : error[key];
+    define(
+      redactedName(key, redactor),
+      // A credential-named member is replaced wholesale, the way the journal's
+      // own walk replaces one, so both halves of the one rule set answer alike.
+      Redaction.isSensitiveKey(key) ? Redaction.placeholder : depth + 1 >= renderDepthLimit ? renderDepthMarker : value instanceof Error ? redactError(value, redactor, seen, depth + 1) : redactor(value),
+      descriptor.enumerable === true
+    );
+  }
+  return clone;
+};
+const redactArgument = (value, redactor) => {
+  try {
+    return value instanceof Error ? redactError(value, redactor, /* @__PURE__ */ new WeakMap()) : redactor(value);
+  } catch {
+    return unrenderableMarker;
+  }
+};
+const unrenderableMarker = "[Unrenderable]";
+const redactingConsole = (target, redactor) => {
+  const methods = target;
+  const view = {};
+  for (const [name, redacts] of Object.entries(consoleMethods)) {
+    const method = methods[name].bind(target);
+    view[name] = redacts ? (...args) => {
+      const redacted = args.map((value) => redactArgument(value, redactor));
+      try {
+        return method(...redacted);
+      } catch {
+        try {
+          return method(...redacted.map(() => unrenderableMarker));
+        } catch {
+          return void 0;
+        }
+      }
+    } : method;
+  }
+  return view;
+};
+const redactedFiber = (fiber, redactor) => {
+  const view = Object.create(fiber);
+  Object.defineProperty(view, "getRef", {
+    value: (reference) => {
+      const current = fiber.getRef(reference);
+      if (reference === Console.Console) {
+        return redactingConsole(current, redactor);
+      }
+      if (reference === References.CurrentLogAnnotations) {
+        return redactArgument(current, redactor);
+      }
+      return current;
+    }
+  });
+  return view;
+};
+const redactedFrame = (frame, redactor, depth = 0) => {
+  if (frame === void 0) return void 0;
+  if (depth >= renderDepthLimit) {
+    return { name: renderDepthMarker, stack: () => void 0, parent: void 0 };
+  }
+  const stack = redactedText(() => frame.stack() ?? "", redactor, unrenderableMarker);
+  return {
+    name: redactedText(() => frame.name, redactor, unrenderableMarker),
+    stack: () => stack,
+    parent: redactedFrame(frame.parent, redactor, depth + 1)
+  };
+};
+const redactedCause = (cause, redactor) => {
+  if (cause.reasons.length === 0) return cause;
+  return Cause.fromReasons(cause.reasons.map((reason) => {
+    const annotations = new Map(reason.annotations);
+    for (const key of [Cause.StackTrace.key, Cause.InterruptorStackTrace.key]) {
+      if (annotations.has(key)) {
+        annotations.set(key, redactedFrame(annotations.get(key), redactor));
+      }
+    }
+    const copy = reason._tag === "Fail" ? Cause.makeFailReason(redactArgument(reason.error, redactor)) : reason._tag === "Die" ? Cause.makeDieReason(redactArgument(reason.defect, redactor)) : Cause.makeInterruptReason(reason.fiberId);
+    return copy.annotate(Context.makeUnsafe(annotations));
+  }));
+};
+const wrap = (logger, options) => {
+  if (isRedacted(logger)) return logger;
+  const redactor = Redaction.make({ onTooDeep: "name", rules: Redaction.diagnosticRules, ...options });
+  const wrapped = Logger.make(
+    (logOptions) => logger.log({
+      ...logOptions,
+      // The message is redacted here, not only behind the fiber's Console,
+      // because a logger is free to read it directly: `Logger.tracerLogger`
+      // ships in Effect's default set and publishes the message as a span
+      // event name, so a Console-only substitution would export a credential
+      // in clear to whatever collector is configured.
+      //
+      // Effect delivers the message as an array of parts, one per argument,
+      // including the single-argument case; a non-array reaches here only from
+      // a caller that builds `LogOptions` by hand, and `toArray` covers it
+      // without a branch no test could reach through the logging API.
+      message: toArray(logOptions.message).map((part) => redactArgument(part, redactor)),
+      // The cause travels the same way and for the same reason. A failure is
+      // logged as a `Cause`, not as message parts (`Effect.logError(cause)`
+      // moves it out of the arguments), and `Logger.tracerLogger` renders it
+      // itself into the span's `effect.cause` attribute without going near the
+      // console, so an error message carrying a token would leave the process
+      // in clear.
+      cause: redactedCause(logOptions.cause, redactor),
+      fiber: redactedFiber(logOptions.fiber, redactor)
+    })
+  );
+  Object.defineProperty(wrapped, TypeId, { value: true });
+  return wrapped;
+};
+const layer = (options) => Layer.effect(
+  Logger.CurrentLoggers,
+  Effect.withFiber(
+    (fiber) => Effect.sync(() => {
+      const wrapped = /* @__PURE__ */ new Set();
+      for (const logger of fiber.getRef(Logger.CurrentLoggers)) wrapped.add(wrap(logger, options));
+      return wrapped;
+    })
+  )
+);
+//# sourceMappingURL=RedactedLogger.js.map