@smthrs/journal 0.0.0-stage → 1.0.0-rc.3

package/dist/cjs/RedactedLogger.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/RedactedLogger.ts"],
+  "sourcesContent": ["/**\n * The redacting logger: the journal's redaction rules applied to log output.\n *\n * The journal redacts on the write path, so a credential a cell logs or\n * returns never reaches a committed row (`./Redaction.ts`). The operator's\n * terminal was the other place the same credential surfaces: every built-in\n * Effect logger renders through the fiber's `Console`, so an action that hands\n * a token to `Effect.logInfo` wrote it to stderr in full and it reached\n * whatever collected that stream.\n *\n * This module closes that half with the SAME rules rather than a second rule\n * set. {@link wrap} does not re-implement redaction and does not re-format a\n * log line. It redacts the log event itself \u2014 the message, the cause, and the\n * log annotations \u2014 before the wrapped logger is handed it, and it hands that\n * logger a view of the fiber whose `Console` is a redacting console, so\n * whatever the logger renders for itself \u2014 a pretty line, a JSON document \u2014\n * passes through `Redaction.redact` on its way to the stream as well.\n *\n * Both halves carry load. Most built-in loggers write through the fiber's\n * `Console`, which is what covers the pretty line, the `--json` document, and\n * the `.flows/logs/<runId>.log` stream. But a logger is free to read the event\n * instead of rendering it, and one in Effect's own default logger set does:\n * `Logger.tracerLogger` publishes the message as a span event name and\n * `Cause.pretty` of the cause as the span's `effect.cause` attribute, and\n * never reads `Console` at all. Redacting only the console would hide a\n * credential on stderr and export it in clear to whatever OTLP collector is\n * configured.\n *\n * Cost is bounded by the rules themselves: every alternation inside a\n * repetition in `Redaction.diagnosticRules` starts its branches with disjoint\n * characters, so each rule is linear in the length of the line and no input\n * backtracks catastrophically.\n *\n * One deliberate difference from the journal write path. `Redaction.redact`\n * rebuilds an object from its own enumerable entries, which is right for a row\n * that is about to be JSON-encoded and wrong for a terminal: an `Error` keeps\n * `message` and `stack` on non-enumerable properties, so rebuilding one prints\n * `{}` where the operator expected a failure. An `Error` is rebuilt as a plain\n * `Error` instead, carrying its name, message, stack and own members with the\n * rules applied. Its class is NOT preserved. A copy built on the original's\n * prototype inherits everything the prototype defines, an own-key walk sees\n * none of it, and each of `name`, `cause`, `toJSON`, `Symbol.toStringTag` and\n * `nodejs.util.inspect.custom` carried a credential out that way.\n *\n * @since 0.1.0\n */\n\nimport * as Cause from \"effect/Cause\"\nimport * as Console from \"effect/Console\"\nimport * as Context from \"effect/Context\"\nimport * as Effect from \"effect/Effect\"\nimport type * as Fiber from \"effect/Fiber\"\nimport * as Layer from \"effect/Layer\"\nimport * as Logger from \"effect/Logger\"\nimport * as References from \"effect/References\"\nimport * as Redaction from \"./Redaction.ts\"\n\n/**\n * Marks a logger this module already wrapped.\n *\n * Both the CLI and the durable runtime install {@link layer}, and a detached\n * `smithers run` is both at once. Wrapping twice would be correct but pay the\n * rules twice per line, so a wrapped logger is returned unchanged.\n *\n * @since 0.1.0\n * @category type ids\n */\nexport const TypeId: unique symbol = Symbol.for(\"@smthrs/journal/RedactedLogger\")\n\n/**\n * Whether {@link wrap} already wrapped this logger.\n *\n * @since 0.1.0\n * @category predicates\n */\nexport const isRedacted = (logger: Logger.Logger<any, any>): boolean => TypeId in logger\n\n/**\n * Console methods that write caller-supplied values, mapped to whether their\n * arguments carry log output.\n *\n * Only `clear` and `groupEnd` are marked `false`, because those two take no\n * arguments at all: there is nothing for the rules to read and binding them\n * straight through saves a copy per call. Every other method here, `count`,\n * `countReset`, `time`, and `timeEnd` included, accepts a caller-supplied\n * LABEL and prints it, so a label of `api_key=sk-\u2026` reached the terminal\n * through all four of them. `timeLog` already redacted its label, so the pair\n * `time` / `timeLog` also disagreed about what a timer is called; redacting all\n * of them is what makes a label match itself again.\n */\nconst consoleMethods = {\n  assert: true,\n  clear: false,\n  count: true,\n  countReset: true,\n  debug: true,\n  dir: true,\n  dirxml: true,\n  error: true,\n  group: true,\n  groupCollapsed: true,\n  groupEnd: false,\n  info: true,\n  log: true,\n  table: true,\n  time: true,\n  timeEnd: true,\n  timeLog: true,\n  trace: true,\n  warn: true\n} as const\n\n/** How deep the logger walks a value before it names it instead. */\nconst renderDepthLimit = 200\n\n/** What the logger renders in place of a value nested past the depth limit. */\nconst renderDepthMarker = \"[Deep]\"\n\n/**\n * The parts of a log message.\n *\n * Effect's logging API passes an array, one entry per argument, including for\n * a single argument. A caller that builds `LogOptions` by hand may pass the\n * message itself, so it is wrapped rather than walked.\n *\n * @since 0.1.0\n * @category redaction\n */\nconst toArray = (message: unknown): ReadonlyArray<unknown> => Array.isArray(message) ? message : [message]\n\n/**\n * Reads one piece of text off `error` and runs it through the rules.\n *\n * Everything a renderer prints about an error is read here, once, and only the\n * redacted result crosses to the copy. A caller's error can define any of these\n * as an accessor that throws, and reading one happens while a log line is\n * rendering, so a refusal costs that piece of text and nothing else.\n */\nconst redactedText = (read: () => unknown, redactor: Redaction.Redactor, fallback: string): string => {\n  try {\n    return String(redactor(String(read())))\n  } catch {\n    return fallback\n  }\n}\n\n/** `error.stack` through the rules, or `undefined` when it has none to give. */\nconst redactedStack = (error: Error, redactor: Redaction.Redactor): string | undefined => {\n  try {\n    const stack = error.stack\n    // An `Error.stack` is optional. Under `exactOptionalPropertyTypes` an\n    // assignment cannot carry the `undefined` a stackless error has, so the\n    // copy defines the property instead of assigning it.\n    return typeof stack === \"string\" ? String(redactor(stack)) : undefined\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * A member NAME with the rules applied, replaced outright when one fires.\n *\n * The treatment `Redaction.redact` gives an object key, for the same reason: a\n * name is text a renderer prints. Rewriting one in place would change what it\n * reads as and redaction would stop being a fixed point, so a name that matches\n * becomes the placeholder whole.\n */\nconst redactedName = (key: string, redactor: Redaction.Redactor): string => {\n  const redacted = String(redactor(key))\n  return redacted === key ? key : Redaction.placeholder\n}\n\n/**\n * Own names the copy never carries, because a renderer CALLS them.\n *\n * `name`, `message` and `stack` are defined from the rules above instead. The\n * rest are hooks: a redacted `toString` or `valueOf` would leave a string under\n * a name the language calls, and `String(error)` would then throw from inside\n * the renderer, which is the failure mode this module exists to avoid.\n */\nconst renderHooks: ReadonlySet<string> = new Set([\n  \"constructor\",\n  \"message\",\n  \"name\",\n  \"stack\",\n  \"toJSON\",\n  \"toString\",\n  \"valueOf\"\n])\n\n/**\n * A copy of `error` carrying the same information with the rules applied.\n *\n * A PLAIN `Error`, never a copy built on the original's prototype. A prototype\n * is an unbounded leak surface and an own-key walk never looks at one: an\n * inherited `name`, `cause`, `toJSON`, `Symbol.toStringTag` or\n * `nodejs.util.inspect.custom` each carried a credential straight to an OTLP\n * span attribute or to the operator's terminal, one per review round, and a\n * getter anywhere on the chain is the same hole with a different name. So\n * nothing inherited crosses. Only redacted text does: the name, the message,\n * the stack, and the error's own members, each read once here and stored as\n * data, since a getter carried across unchanged would hand the unredacted\n * value to whatever reads it next.\n *\n * The copy is not an instance of the original's class, so a renderer that\n * special-cases `instanceof MyError` sees a plain `Error`. That is the fidelity\n * trade the release policy already records for every other value, and it is\n * the trade the same problem's earlier, crashing form was settled with: a copy\n * on a host prototype, such as the `DOMException` an `AbortSignal` carries as\n * its reason, is an impostor whose brand check throws from inside `Cause.pretty`\n * and kills the run the line was describing.\n */\nconst redactError = (\n  error: Error,\n  redactor: Redaction.Redactor,\n  seen: WeakMap<Error, Error>,\n  depth = 0\n): Error => {\n  // The memo holds the COPY, not a visited mark: returning the original on a\n  // repeat reference put the unredacted error back into the output, so a\n  // diamond (two fields naming one error) leaked on its second field. The copy\n  // is registered before its own members are walked, so a cycle terminates on\n  // it and every reference to one error is the same redacted object.\n  const memoized = seen.get(error)\n  if (memoized !== undefined) return memoized\n  const clone = new Error()\n  seen.set(error, clone)\n  const define = (key: string, value: unknown, enumerable: boolean): void => {\n    Object.defineProperty(clone, key, { value, writable: true, enumerable, configurable: true })\n  }\n  define(\"name\", redactedText(() => error.name, redactor, \"Error\"), false)\n  define(\"message\", redactedText(() => error.message, redactor, \"\"), false)\n  define(\"stack\", redactedStack(error, redactor), false)\n  // Own NAMES, not `Reflect.ownKeys`. A symbol key never crosses: its\n  // description is text no walk can rewrite in place, and the three hooks with\n  // no name to skip are symbols too, `Symbol.toPrimitive`,\n  // `Symbol.toStringTag`, and `nodejs.util.inspect.custom`.\n  for (const key of Object.getOwnPropertyNames(error)) {\n    if (renderHooks.has(key)) continue\n    const descriptor = Object.getOwnPropertyDescriptor(error, key)!\n    const value = \"value\" in descriptor\n      ? descriptor.value\n      : (error as unknown as Record<PropertyKey, unknown>)[key]\n    define(\n      redactedName(key, redactor),\n      // A credential-named member is replaced wholesale, the way the journal's\n      // own walk replaces one, so both halves of the one rule set answer alike.\n      Redaction.isSensitiveKey(key)\n        ? Redaction.placeholder\n        // The depth cap binds under an Error exactly as it does beside one: a\n        // deep value carried on a cause can exhaust the stack just as easily.\n        : depth + 1 >= renderDepthLimit\n        ? renderDepthMarker\n        : value instanceof Error\n        ? redactError(value, redactor, seen, depth + 1)\n        : redactor(value),\n      descriptor.enumerable === true\n    )\n  }\n  return clone\n}\n\n/**\n * Redacts one value on its way out of the logger.\n *\n * An `Error` is rebuilt as a plain `Error` whose name, message, stack and own\n * members are redacted, so a renderer that special-cases an `Error` still gets\n * one. Everything else goes through the journal's own rules, which rebuild a\n * value from its plain data: a `Date`, a `Map`, a class instance or a host\n * object therefore reaches the operator in that plain form rather than as\n * itself.\n *\n * That collapse is deliberate, and it now covers the `Error` too. An earlier\n * version rebuilt each value on its own prototype to keep the rendering\n * faithful. Three rounds of review found three ways that could kill the run it\n * was logging, because a host class keeps state a property walk cannot see and\n * a copy of one throws the moment a brand check reads it, and four more found\n * that the prototype an `Error` copy kept was itself the leak: everything it\n * defines is read by a renderer and seen by no own-key walk. A log line is not\n * worth a run, and the rendering it buys is cosmetic.\n *\n * @since 0.1.0\n * @category redaction\n */\nexport const redactArgument = (value: unknown, redactor: Redaction.Redactor): unknown => {\n  try {\n    return value instanceof Error ? redactError(value, redactor, new WeakMap()) : redactor(value)\n  } catch {\n    // A logged value is arbitrary and a throw here happens while the line is\n    // rendering, which would kill the run the line describes. The marker is\n    // deliberately NOT derived from the value: an earlier fallback rendered\n    // the value to text and printed it, and that text had never been through\n    // the rules, so a credential reached the terminal in clear.\n    return unrenderableMarker\n  }\n}\n\n/** What the logger renders in place of a value that cannot be rendered. */\nconst unrenderableMarker = \"[Unrenderable]\"\n\n/**\n * A console that runs every value it is handed through `redactor` and then\n * delegates to `target`.\n *\n * @since 0.1.0\n * @category constructors\n */\nexport const redactingConsole = (target: Console.Console, redactor: Redaction.Redactor): Console.Console => {\n  const methods = target as unknown as Record<string, (...args: ReadonlyArray<any>) => unknown>\n  const view: Record<string, unknown> = {}\n  for (const [name, redacts] of Object.entries(consoleMethods)) {\n    const method = methods[name]!.bind(target)\n    view[name] = redacts\n      ? (...args: ReadonlyArray<unknown>) => {\n        const redacted = args.map((value) => redactArgument(value, redactor))\n        try {\n          return method(...redacted)\n        } catch {\n          // The delegate refused what we handed it. Retry with markers, never\n          // with a rendering of the values: a rendering has not been through\n          // the rules, and printing one is how a credential reached the\n          // terminal before. A delegate that refuses the markers too is out of\n          // options, and a log line is not worth the run.\n          try {\n            return method(...redacted.map(() => unrenderableMarker))\n          } catch {\n            return undefined\n          }\n        }\n      }\n      : method\n  }\n  return view as unknown as Console.Console\n}\n\n/**\n * A view of `fiber` whose console redacts and whose log annotations are\n * already redacted.\n *\n * The view inherits from the fiber itself, so `id`, `currentSpan`, and every\n * other member a logger reads answer exactly as before; only the two\n * references a logger renders from are substituted.\n */\nconst redactedFiber = (\n  fiber: Fiber.Fiber<unknown, unknown>,\n  redactor: Redaction.Redactor\n): Fiber.Fiber<unknown, unknown> => {\n  const view = Object.create(fiber) as Fiber.Fiber<unknown, unknown>\n  Object.defineProperty(view, \"getRef\", {\n    value: <X>(reference: Context.Reference<X>): X => {\n      const current = fiber.getRef(reference)\n      if (reference === (Console.Console as unknown as Context.Reference<X>)) {\n        return redactingConsole(current as Console.Console, redactor) as X\n      }\n      if (reference === (References.CurrentLogAnnotations as unknown as Context.Reference<X>)) {\n        // The same treatment a message part gets, so one log event obeys one\n        // rule and an annotated Error is redacted like a logged one.\n        return redactArgument(current, redactor) as X\n      }\n      return current\n    }\n  })\n  return view\n}\n\n/**\n * Rebuilds the frame chain as redacted data. Evaluate the lazy stack here:\n * carrying its original function would defer the credential past the boundary.\n * The same depth cap as logged values also bounds cyclic parent chains.\n */\nconst redactedFrame = (\n  frame: References.StackFrame | undefined,\n  redactor: Redaction.Redactor,\n  depth = 0\n): References.StackFrame | undefined => {\n  if (frame === undefined) return undefined\n  if (depth >= renderDepthLimit) {\n    return { name: renderDepthMarker, stack: () => undefined, parent: undefined }\n  }\n  const stack = redactedText(() => frame.stack() ?? \"\", redactor, unrenderableMarker)\n  return {\n    name: redactedText(() => frame.name, redactor, unrenderableMarker),\n    stack: () => stack,\n    parent: redactedFrame(frame.parent, redactor, depth + 1)\n  }\n}\n\n/**\n * The log event's cause with the rules applied to failures, defects and stack\n * annotations. `Cause.pretty` renders these frames after rendering the error;\n * the tracer exports that text without passing through the redacting console.\n * Interruptions also carry both their own and the interruptor's frame chains.\n * Rebuild reasons and annotation maps so the original cause stays untouched.\n */\nconst redactedCause = (\n  cause: Cause.Cause<unknown>,\n  redactor: Redaction.Redactor\n): Cause.Cause<unknown> => {\n  if (cause.reasons.length === 0) return cause\n  return Cause.fromReasons(cause.reasons.map((reason) => {\n    const annotations = new Map(reason.annotations)\n    for (const key of [Cause.StackTrace.key, Cause.InterruptorStackTrace.key]) {\n      if (annotations.has(key)) {\n        annotations.set(key, redactedFrame(annotations.get(key) as References.StackFrame | undefined, redactor))\n      }\n    }\n    const copy = reason._tag === \"Fail\"\n      ? Cause.makeFailReason(redactArgument(reason.error, redactor))\n      : reason._tag === \"Die\"\n      ? Cause.makeDieReason(redactArgument(reason.defect, redactor))\n      : Cause.makeInterruptReason(reason.fiberId)\n    return copy.annotate(Context.makeUnsafe(annotations))\n  }))\n}\n\n/**\n * Returns `logger` with the journal's redaction rules over everything it\n * renders. A logger this module already wrapped is returned unchanged.\n *\n * @since 0.1.0\n * @category combinators\n */\nexport const wrap = <Message, Output>(\n  logger: Logger.Logger<Message, Output>,\n  options?: Redaction.Options\n): Logger.Logger<Message, Output> => {\n  if (isRedacted(logger)) return logger\n  // A logger NAMES a too-deep value rather than throwing: a throw is caught one\n  // frame up and costs the operator every argument on the line, not just the\n  // deep one. A log line is a diagnostic, so it takes the diagnostic rules. A\n  // caller passing its own `onTooDeep` or `rules` still wins.\n  const redactor = Redaction.make({ onTooDeep: \"name\", rules: Redaction.diagnosticRules, ...options })\n  const wrapped = Logger.make<Message, Output>((logOptions) =>\n    logger.log({\n      ...logOptions,\n      // The message is redacted here, not only behind the fiber's Console,\n      // because a logger is free to read it directly: `Logger.tracerLogger`\n      // ships in Effect's default set and publishes the message as a span\n      // event name, so a Console-only substitution would export a credential\n      // in clear to whatever collector is configured.\n      //\n      // Effect delivers the message as an array of parts, one per argument,\n      // including the single-argument case; a non-array reaches here only from\n      // a caller that builds `LogOptions` by hand, and `toArray` covers it\n      // without a branch no test could reach through the logging API.\n      message: (toArray(logOptions.message).map((part) => redactArgument(part, redactor))) as Message,\n      // The cause travels the same way and for the same reason. A failure is\n      // logged as a `Cause`, not as message parts (`Effect.logError(cause)`\n      // moves it out of the arguments), and `Logger.tracerLogger` renders it\n      // itself into the span's `effect.cause` attribute without going near the\n      // console, so an error message carrying a token would leave the process\n      // in clear.\n      cause: redactedCause(logOptions.cause, redactor),\n      fiber: redactedFiber(logOptions.fiber, redactor)\n    })\n  )\n  Object.defineProperty(wrapped, TypeId, { value: true })\n  return wrapped\n}\n\n/**\n * Replaces the active logger set with redacting wrappers of the same loggers.\n *\n * It composes over whatever loggers are already installed rather than\n * choosing one, so an operator keeps the FORMAT they had, meaning their own\n * logger and its layout, though a value inside a line is rendered from its\n * redacted plain data rather than as its own class, and a host that\n * installed its own logger keeps it too.\n *\n * @since 0.1.0\n * @category layers\n */\nexport const layer = (options?: Redaction.Options): Layer.Layer<never> =>\n  Layer.effect(\n    Logger.CurrentLoggers,\n    Effect.withFiber((fiber) =>\n      Effect.sync(() => {\n        const wrapped = new Set<Logger.Logger<unknown, any>>()\n        for (const logger of fiber.getRef(Logger.CurrentLoggers)) wrapped.add(wrap(logger, options))\n        return wrapped\n      })\n    )\n  )\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+CA,YAAuB;AACvB,cAAyB;AACzB,cAAyB;AACzB,aAAwB;AAExB,YAAuB;AACvB,aAAwB;AACxB,iBAA4B;AAC5B,gBAA2B;AAYpB,MAAM,SAAwB,uBAAO,IAAI,gCAAgC;AAQzE,MAAM,aAAa,CAAC,WAA6C,UAAU;AAelF,MAAM,iBAAiB;AAAA,EACrB,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,OAAO;AAAA,EACP,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,OAAO;AAAA,EACP,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,MAAM;AAAA,EACN,KAAK;AAAA,EACL,OAAO;AAAA,EACP,MAAM;AAAA,EACN,SAAS;AAAA,EACT,SAAS;AAAA,EACT,OAAO;AAAA,EACP,MAAM;AACR;AAGA,MAAM,mBAAmB;AAGzB,MAAM,oBAAoB;AAY1B,MAAM,UAAU,CAAC,YAA6C,MAAM,QAAQ,OAAO,IAAI,UAAU,CAAC,OAAO;AAUzG,MAAM,eAAe,CAAC,MAAqB,UAA8B,aAA6B;AACpG,MAAI;AACF,WAAO,OAAO,SAAS,OAAO,KAAK,CAAC,CAAC,CAAC;AAAA,EACxC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,MAAM,gBAAgB,CAAC,OAAc,aAAqD;AACxF,MAAI;AACF,UAAM,QAAQ,MAAM;AAIpB,WAAO,OAAO,UAAU,WAAW,OAAO,SAAS,KAAK,CAAC,IAAI;AAAA,EAC/D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUA,MAAM,eAAe,CAAC,KAAa,aAAyC;AAC1E,QAAM,WAAW,OAAO,SAAS,GAAG,CAAC;AACrC,SAAO,aAAa,MAAM,MAAM,UAAU;AAC5C;AAUA,MAAM,cAAmC,oBAAI,IAAI;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAwBD,MAAM,cAAc,CAClB,OACA,UACA,MACA,QAAQ,MACE;AAMV,QAAM,WAAW,KAAK,IAAI,KAAK;AAC/B,MAAI,aAAa,OAAW,QAAO;AACnC,QAAM,QAAQ,IAAI,MAAM;AACxB,OAAK,IAAI,OAAO,KAAK;AACrB,QAAM,SAAS,CAAC,KAAa,OAAgB,eAA8B;AACzE,WAAO,eAAe,OAAO,KAAK,EAAE,OAAO,UAAU,MAAM,YAAY,cAAc,KAAK,CAAC;AAAA,EAC7F;AACA,SAAO,QAAQ,aAAa,MAAM,MAAM,MAAM,UAAU,OAAO,GAAG,KAAK;AACvE,SAAO,WAAW,aAAa,MAAM,MAAM,SAAS,UAAU,EAAE,GAAG,KAAK;AACxE,SAAO,SAAS,cAAc,OAAO,QAAQ,GAAG,KAAK;AAKrD,aAAW,OAAO,OAAO,oBAAoB,KAAK,GAAG;AACnD,QAAI,YAAY,IAAI,GAAG,EAAG;AAC1B,UAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAC7D,UAAM,QAAQ,WAAW,aACrB,WAAW,QACV,MAAkD,GAAG;AAC1D;AAAA,MACE,aAAa,KAAK,QAAQ;AAAA;AAAA;AAAA,MAG1B,UAAU,eAAe,GAAG,IACxB,UAAU,cAGV,QAAQ,KAAK,mBACb,oBACA,iBAAiB,QACjB,YAAY,OAAO,UAAU,MAAM,QAAQ,CAAC,IAC5C,SAAS,KAAK;AAAA,MAClB,WAAW,eAAe;AAAA,IAC5B;AAAA,EACF;AACA,SAAO;AACT;AAwBO,MAAM,iBAAiB,CAAC,OAAgB,aAA0C;AACvF,MAAI;AACF,WAAO,iBAAiB,QAAQ,YAAY,OAAO,UAAU,oBAAI,QAAQ,CAAC,IAAI,SAAS,KAAK;AAAA,EAC9F,QAAQ;AAMN,WAAO;AAAA,EACT;AACF;AAGA,MAAM,qBAAqB;AASpB,MAAM,mBAAmB,CAAC,QAAyB,aAAkD;AAC1G,QAAM,UAAU;AAChB,QAAM,OAAgC,CAAC;AACvC,aAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,cAAc,GAAG;AAC5D,UAAM,SAAS,QAAQ,IAAI,EAAG,KAAK,MAAM;AACzC,SAAK,IAAI,IAAI,UACT,IAAI,SAAiC;AACrC,YAAM,WAAW,KAAK,IAAI,CAAC,UAAU,eAAe,OAAO,QAAQ,CAAC;AACpE,UAAI;AACF,eAAO,OAAO,GAAG,QAAQ;AAAA,MAC3B,QAAQ;AAMN,YAAI;AACF,iBAAO,OAAO,GAAG,SAAS,IAAI,MAAM,kBAAkB,CAAC;AAAA,QACzD,QAAQ;AACN,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF,IACE;AAAA,EACN;AACA,SAAO;AACT;AAUA,MAAM,gBAAgB,CACpB,OACA,aACkC;AAClC,QAAM,OAAO,OAAO,OAAO,KAAK;AAChC,SAAO,eAAe,MAAM,UAAU;AAAA,IACpC,OAAO,CAAI,cAAuC;AAChD,YAAM,UAAU,MAAM,OAAO,SAAS;AACtC,UAAI,cAAe,QAAQ,SAA6C;AACtE,eAAO,iBAAiB,SAA4B,QAAQ;AAAA,MAC9D;AACA,UAAI,cAAe,WAAW,uBAA2D;AAGvF,eAAO,eAAe,SAAS,QAAQ;AAAA,MACzC;AACA,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAOA,MAAM,gBAAgB,CACpB,OACA,UACA,QAAQ,MAC8B;AACtC,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,SAAS,kBAAkB;AAC7B,WAAO,EAAE,MAAM,mBAAmB,OAAO,MAAM,QAAW,QAAQ,OAAU;AAAA,EAC9E;AACA,QAAM,QAAQ,aAAa,MAAM,MAAM,MAAM,KAAK,IAAI,UAAU,kBAAkB;AAClF,SAAO;AAAA,IACL,MAAM,aAAa,MAAM,MAAM,MAAM,UAAU,kBAAkB;AAAA,IACjE,OAAO,MAAM;AAAA,IACb,QAAQ,cAAc,MAAM,QAAQ,UAAU,QAAQ,CAAC;AAAA,EACzD;AACF;AASA,MAAM,gBAAgB,CACpB,OACA,aACyB;AACzB,MAAI,MAAM,QAAQ,WAAW,EAAG,QAAO;AACvC,SAAO,MAAM,YAAY,MAAM,QAAQ,IAAI,CAAC,WAAW;AACrD,UAAM,cAAc,IAAI,IAAI,OAAO,WAAW;AAC9C,eAAW,OAAO,CAAC,MAAM,WAAW,KAAK,MAAM,sBAAsB,GAAG,GAAG;AACzE,UAAI,YAAY,IAAI,GAAG,GAAG;AACxB,oBAAY,IAAI,KAAK,cAAc,YAAY,IAAI,GAAG,GAAwC,QAAQ,CAAC;AAAA,MACzG;AAAA,IACF;AACA,UAAM,OAAO,OAAO,SAAS,SACzB,MAAM,eAAe,eAAe,OAAO,OAAO,QAAQ,CAAC,IAC3D,OAAO,SAAS,QAChB,MAAM,cAAc,eAAe,OAAO,QAAQ,QAAQ,CAAC,IAC3D,MAAM,oBAAoB,OAAO,OAAO;AAC5C,WAAO,KAAK,SAAS,QAAQ,WAAW,WAAW,CAAC;AAAA,EACtD,CAAC,CAAC;AACJ;AASO,MAAM,OAAO,CAClB,QACA,YACmC;AACnC,MAAI,WAAW,MAAM,EAAG,QAAO;AAK/B,QAAM,WAAW,UAAU,KAAK,EAAE,WAAW,QAAQ,OAAO,UAAU,iBAAiB,GAAG,QAAQ,CAAC;AACnG,QAAM,UAAU,OAAO;AAAA,IAAsB,CAAC,eAC5C,OAAO,IAAI;AAAA,MACT,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWH,SAAU,QAAQ,WAAW,OAAO,EAAE,IAAI,CAAC,SAAS,eAAe,MAAM,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOlF,OAAO,cAAc,WAAW,OAAO,QAAQ;AAAA,MAC/C,OAAO,cAAc,WAAW,OAAO,QAAQ;AAAA,IACjD,CAAC;AAAA,EACH;AACA,SAAO,eAAe,SAAS,QAAQ,EAAE,OAAO,KAAK,CAAC;AACtD,SAAO;AACT;AAcO,MAAM,QAAQ,CAAC,YACpB,MAAM;AAAA,EACJ,OAAO;AAAA,EACP,OAAO;AAAA,IAAU,CAAC,UAChB,OAAO,KAAK,MAAM;AAChB,YAAM,UAAU,oBAAI,IAAiC;AACrD,iBAAW,UAAU,MAAM,OAAO,OAAO,cAAc,EAAG,SAAQ,IAAI,KAAK,QAAQ,OAAO,CAAC;AAC3F,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;",
+  "names": []
+}

package/dist/cjs/Redaction.d.ts

@@ -0,0 +1,350 @@
+/**
+ * Payload redaction for durable journal writes.
+ *
+ * The journal is permanent and broadly readable: every entry is replayed to
+ * sync subscribers and to time-travel consumers. A secret that reaches
+ * `payload_json` is therefore not a transient leak, so redaction happens once,
+ * on the journal write path, rather than at each reader.
+ *
+ * Redaction is an **observability** concern and is confined to journal events
+ * and export/display surfaces. It is deliberately not applied to executable
+ * state, `flows_runs.state_json`, attempt checkpoints, errors, outcomes, and
+ * cache results, because those are decoded and re-entered on resume: a
+ * placeholder there resumes the flow with the wrong data, and replacing a
+ * non-string value with a placeholder string makes the persisted state fail
+ * schema decode outright, leaving the run undrivable (issue #72). A value
+ * that must never reach durable executable state is a `Redacted` field in the
+ * caller's own schema, not a name-suffix guess made at the storage seam.
+ *
+ * The rule set is a best-effort textual net over credential shapes seen in
+ * real bug reports, plus structural redaction by sensitive field name. It is
+ * finite, so a value that must never persist belongs in a `Redacted` field of
+ * the caller's own schema. See https://journal.smithers.sh/concepts/redaction/
+ * for the rule set and how to replace it.
+ *
+ * @since 0.1.0
+ */
+import * as Schema from "effect/Schema";
+/**
+ * A textual redaction rule.
+ *
+ * `replace` is the substitution for a matched span; when omitted the whole
+ * match is replaced by the placeholder.
+ *
+ * `rewrite`, when set, rewrites the text itself instead. It is for a rule
+ * whose extent is not regular: where a credential's value ends depends on
+ * quotes, escapes and brackets a regular expression cannot count. `pattern`
+ * then names what the rule looks for, and text `pattern` does not match is
+ * left unchanged without calling `rewrite`.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export interface Rule {
+    readonly id: string;
+    readonly pattern: RegExp;
+    readonly replace?: string | undefined;
+    readonly rewrite?: ((text: string) => string) | undefined;
+}
+/**
+ * The placeholder written in place of a redacted value.
+ *
+ * @since 0.1.0
+ * @category constants
+ */
+export declare const placeholder = "[REDACTED]";
+/**
+ * Best-effort textual rules for credential shapes observed in real reports.
+ * Every replacement reaches a fixed point so replaying or exporting an entry
+ * cannot mutate it again.
+ *
+ * @since 0.1.0
+ * @category constants
+ */
+export declare const defaultRules: ReadonlyArray<Rule>;
+/**
+ * The rules for a diagnostic: {@link defaultRules} and the spellings too broad
+ * for a durable row.
+ *
+ * A log line, a stderr message, and an error handed to a remote caller are
+ * read once, so a false positive costs a word of context. A journal row is
+ * permanent, so the same false positive destroys data. These rules sit on the
+ * diagnostic side of that line: an authorization header in any scheme, bare
+ * URL userinfo (`https://token@host`), a signed query parameter, and the value
+ * of a `-p` flag, which is a password to `mysql` and `sshpass` and a path to
+ * `mkdir`. A path, a port and a lowercase word attached to `-p` (`-print`,
+ * `-path`) are left alone.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export declare const diagnosticRules: ReadonlyArray<Rule>;
+/**
+ * Redacts one diagnostic value with {@link diagnosticRules}: a log line, a
+ * stderr message, an error handed back to a caller.
+ *
+ * Every diagnostic path shares this one function, and it runs on the value
+ * before anything renders or bounds it. Redacting a rendering line by line, or
+ * after a bound, is how a secret escaped: `util.inspect` splits a long string
+ * over several lines, and a bound cuts a quoted value before its closing
+ * quote. A value past {@link maxDepth} is named rather than thrown.
+ *
+ * @since 1.0.0
+ * @category redaction
+ */
+export declare const redactDiagnostic: (value: unknown) => unknown;
+/**
+ * Whether a field name names a credential.
+ *
+ * Case and separators are ignored, so `api_key`, `apiKey`, and `x-api-key` are
+ * all recognised, one trailing plural `s` is stripped so `credentials` reads as
+ * `credential`, and a trailing `key` counts where it is a word of its own or
+ * where the word before it names a secret.
+ *
+ * The rule is a suffix test, not a substring test. `tokenizer`, `secretary`,
+ * `monkey`, and `idempotencyKey` are ordinary field names, and replacing their
+ * values would destroy data in a permanent row without protecting anything.
+ * That is the one place this rule is deliberately narrower than
+ * `packages/smithers/src/Bug.ts`'s substring form, which can afford the false
+ * positives because its output is a single report an operator reads once.
+ *
+ * @since 0.1.0
+ * @category predicates
+ */
+export declare const isSensitiveKey: (key: string) => boolean;
+/**
+ * Maximum number of container edges traversed from a redaction root.
+ *
+ * Journal event schemas never approach 256 nested containers. This bound is
+ * far above practical payloads while keeping traversal safely below Node's
+ * call-stack limit for hostile input.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export declare const maxDepth = 256;
+declare const RedactionDepthError_base: Schema.Class<RedactionDepthError, Schema.TaggedStruct<"@smthrs/journal/RedactionDepthError", {
+    readonly code: Schema.Literal<"depth_exceeded">;
+    readonly maxDepth: Schema.Number;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A payload nested deeper than {@link maxDepth}, under `onTooDeep: "throw"`.
+ * `code` is always `depth_exceeded`; `maxDepth` is the bound that was crossed.
+ *
+ * @since 1.0.0
+ * @category errors
+ */
+export declare class RedactionDepthError extends RedactionDepthError_base {
+    readonly name = "RedactionDepthError";
+}
+/**
+ * Options for {@link redact}.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export interface Options {
+    readonly rules?: ReadonlyArray<Rule> | undefined;
+    /**
+     * What a value nested past {@link maxDepth} does.
+     *
+     * `"throw"`, the default, is the journal's contract: a payload that deep is a
+     * caller bug, and a durable row quietly truncated to a marker is worse than a
+     * refused write. `"name"` is what a LOGGER wants, because a throw there is
+     * caught one frame up and replaces EVERY argument on the line with
+     * `[Unrenderable]`, so one deep member would cost the operator the whole line.
+     */
+    readonly onTooDeep?: "throw" | "name" | undefined;
+}
+/**
+ * How many bytes a view may hold, and how many own members {@link redact} reads
+ * off it, before it stops reading them.
+ *
+ * Enumerating a view's own properties materialises one pair per byte, so the
+ * walk costs the buffer's size even though the rendering does not. Both halves
+ * of the bound carry load, and neither is a bound on its own. A size alone is
+ * not, because `byteLength` was read as an ordinary property and an ordinary
+ * property can be shadowed: a pooled chunk that reports the bytes it has used
+ * rather than the bytes it holds is a plain pattern, not an adversarial one,
+ * and a 4 MB chunk reporting 12 walked one property per byte anyway. A count
+ * alone is not, because a caller can hang a million properties on a ten-byte
+ * view. So the size is read from the value's own internal slot, where nothing
+ * a caller writes can answer for it, and the members are counted as they are
+ * walked.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+export declare const binaryWalkLimit = 65536;
+/**
+ * The key {@link redact} files a binary view's size under.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+export declare const binaryMarker = "[Binary]";
+/**
+ * What {@link redact} writes in place of a function or a class object.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+export declare const functionMarker = "[Function]";
+/**
+ * What {@link redact} writes in place of a symbol.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+export declare const symbolMarker = "[Symbol]";
+/**
+ * What {@link redact} writes past {@link maxDepth} under `onTooDeep: "name"`.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+export declare const depthMarker = "[Deep]";
+/**
+ * Returns `value` with credentials removed.
+ *
+ * Objects and arrays are rebuilt: a field whose name {@link isSensitiveKey}
+ * is replaced wholesale, every other string is run through the textual rules,
+ * and a cycle is collapsed to `"[Circular]"` so the result always encodes.
+ * A number, a boolean, `null` and `undefined` are returned untouched, because
+ * redacting one destroys data without protecting anything. A function and a
+ * symbol are NAMED, {@link functionMarker} and {@link symbolMarker}: a body, an
+ * own property and a description are all text a renderer prints, and none of it
+ * can be rewritten in place.
+ *
+ * Traversal accepts at most {@link maxDepth} container edges. A deeper value
+ * throws by default, so the journal boundary can report a typed `invalid_event`
+ * instead of overflowing the runtime stack. {@link Options.onTooDeep} set to
+ * `"name"` writes {@link depthMarker} in its place instead, which is what a
+ * logger wants.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+export declare const redact: (value: unknown, options?: Options) => unknown;
+/**
+ * A redaction function, as the journal consumes it.
+ *
+ * @since 0.1.0
+ * @category models
+ */
+export type Redactor = (value: unknown) => unknown;
+/**
+ * Builds a redactor over a rule set.
+ *
+ * @since 0.1.0
+ * @category constructors
+ */
+export declare const make: (options?: Options) => Redactor;
+/**
+ * Applies a redactor to an already-encoded JSON string, returning the
+ * re-encoded result.
+ *
+ * For export and display surfaces that hold a column verbatim, a rendered
+ * `state_json`, a support bundle, where the value is already encoded and must
+ * not be decoded into the executable path. A string that does not parse is
+ * returned untouched: validation is the caller's, and rejecting here would
+ * turn a redaction concern into a schema error. Once parsing succeeds, a
+ * throwing redactor or an encoding failure returns the valid JSON string
+ * `"[REDACTED]"`; the original parsed text is never returned.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+export declare const redactJsonString: (json: string, redactor: Redactor) => string;
+/**
+ * Redacts a stream one line at a time.
+ *
+ * @since 1.0.0
+ * @category models
+ */
+export interface LineRedactor {
+    /**
+     * Takes the rest of the current line, without its newline, and returns the
+     * lines now safe to emit: none while a value is still open.
+     */
+    readonly line: (line: string) => ReadonlyArray<string>;
+    /**
+     * Takes part of a line whose newline has not arrived. A line longer than
+     * {@link maxPartialLine} is never emitted: {@link omittedLine} stands for it.
+     */
+    readonly part: (text: string) => void;
+    /** What {@link LineRedactor.flush} would emit now, without ending the stream: for a rendered snapshot. */
+    readonly peek: () => ReadonlyArray<string>;
+    /** Ends the stream and returns whatever is still held, redacted as one block. */
+    readonly flush: () => ReadonlyArray<string>;
+}
+/**
+ * Lines a {@link lineRedactor} holds for one open value. Past this, or past
+ * 64 KiB, it stops holding: it emits what it held, redacted, and withholds
+ * every later line until the stream ends, when one placeholder stands for
+ * them. Dropping lines from the middle instead changed which brackets and
+ * quotes were open, and released a later secret in clear.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export declare const maxHeldLines = 256;
+/**
+ * The longest line a {@link lineRedactor} reads whole. A longer line keeps
+ * its first and last 16 KiB; its middle is scanned for what it leaves open
+ * and dropped.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export declare const maxPartialLine: number;
+/**
+ * What a {@link lineRedactor} emits in place of a line longer than
+ * {@link maxPartialLine}.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export declare const omittedLine = "[overlong line omitted]";
+/**
+ * A redactor for a stream that must be emitted line by line: a live build
+ * log, a child's stderr.
+ *
+ * Redacting each line alone is the flaw that leaked a private key's body, and
+ * the tail of every string `util.inspect` split over several lines: only the
+ * line holding the name was redacted. This one asks the rules themselves
+ * whether a line leaves a value open, by checking whether the value swallows
+ * a probe placed on the next line, and holds lines until it closes. The held
+ * block is then redacted whole, exactly as {@link redact} redacts a string.
+ *
+ * A line longer than {@link maxPartialLine} is read as its first and last
+ * 16 KiB. Its middle is dropped, but a bracket, quote or key block the middle
+ * leaves open would have opened a value the kept ends cannot show, so then
+ * the rest of the stream is withheld. Such a line is never emitted, only
+ * {@link omittedLine}, and neither is any block it was held in.
+ *
+ * Its state is bounded whatever the stream does: the line still arriving is
+ * a 16 KiB head, a 16 KiB tail and at most 1024 open brackets or strings of
+ * its middle, a middle nested deeper counting as one left open; the held
+ * block is bounded by {@link maxHeldLines} and 64 KiB. Its cost is linear:
+ * past the first 16 held lines the block is re-read only once it has grown
+ * by half, on Node and on Bun alike (#3088).
+ *
+ * `rules` defaults to {@link diagnosticRules}. The array is read on every
+ * line, so a caller may add a rule, a session secret, as the stream runs.
+ *
+ * @since 1.0.0
+ * @category constructors
+ */
+export declare const lineRedactor: (rules?: ReadonlyArray<Rule>) => LineRedactor;
+/**
+ * The identity redactor, for a caller that persists payloads verbatim by
+ * choice: a trusted single-tenant store, or a suite asserting on raw input.
+ *
+ * @since 0.1.0
+ * @category constructors
+ */
+export declare const makeNoop: () => Redactor;
+export {};
+//# sourceMappingURL=Redaction.d.ts.map

package/dist/cjs/Redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Redaction.d.ts","sourceRoot":"","sources":["../../src/Redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAKvC;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GAAG,SAAS,CAAA;CAC1D;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,eAAe,CAAA;AA4qBvC;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,aAAa,CAAC,IAAI,CA4G5C,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,IAAI,CAiF/C,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,OAAO,KAAG,OACY,CAAA;AA0F9D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,KAAG,OAI5C,CAAA;AAiFD;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,MAAM,CAAA;;;;;;AAE3B;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,wBAGxC;IACC,SAAkB,IAAI,yBAAwB;CAC/C;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,SAAS,CAAA;IAChD;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAA;CAClD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,eAAe,QAAS,CAAA;AA+ErC;;;;;GAKG;AACH,eAAO,MAAM,YAAY,aAAa,CAAA;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,cAAc,eAAe,CAAA;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,YAAY,aAAa,CAAA;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,WAAW,WAAW,CAAA;AAEnC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,MAAM,GAAI,OAAO,OAAO,EAAE,UAAU,OAAO,KAAG,OAkI1D,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAA;AAElD;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,UAAU,OAAO,KAAG,QAA6C,CAAA;AAEtF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,EAAE,UAAU,QAAQ,KAAG,MAMnE,CAAA;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,aAAa,CAAC,MAAM,CAAC,CAAA;IACtD;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACrC,0GAA0G;IAC1G,QAAQ,CAAC,IAAI,EAAE,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,iFAAiF;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;CAC5C;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,MAAM,CAAA;AAe/B;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAY,CAAA;AAEvC;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,4BAA4B,CAAA;AAiBpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,YAAY,GAAI,QAAO,aAAa,CAAC,IAAI,CAAmB,KAAG,YA6H3E,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,QAAO,QAA4B,CAAA"}