@smthrs/journal 0.0.0-stage → 1.0.0-rc.3

package/dist/cjs/Redaction.js

@@ -0,0 +1,928 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var Redaction_exports = {};
+__export(Redaction_exports, {
+  RedactionDepthError: () => RedactionDepthError,
+  binaryMarker: () => binaryMarker,
+  binaryWalkLimit: () => binaryWalkLimit,
+  defaultRules: () => defaultRules,
+  depthMarker: () => depthMarker,
+  diagnosticRules: () => diagnosticRules,
+  functionMarker: () => functionMarker,
+  isSensitiveKey: () => isSensitiveKey,
+  lineRedactor: () => lineRedactor,
+  make: () => make,
+  makeNoop: () => makeNoop,
+  maxDepth: () => maxDepth,
+  maxHeldLines: () => maxHeldLines,
+  maxPartialLine: () => maxPartialLine,
+  omittedLine: () => omittedLine,
+  placeholder: () => placeholder,
+  redact: () => redact,
+  redactDiagnostic: () => redactDiagnostic,
+  redactJsonString: () => redactJsonString,
+  symbolMarker: () => symbolMarker
+});
+module.exports = __toCommonJS(Redaction_exports);
+var Result = __toESM(require("effect/Result"), 1);
+var Schema = __toESM(require("effect/Schema"), 1);
+const UnknownFromJsonString = Schema.fromJsonString(Schema.Unknown);
+const placeholder = "[REDACTED]";
+const isQuote = (char) => char === '"' || char === "'" || char === "`";
+const closers = { "{": "}", "[": "]", "(": ")" };
+let lastClosed = false;
+const skipQuoted = (text, open, depth, modulus = 2 * (depth + 1), limit = text.length) => {
+  let end = open + 1;
+  while (end < limit) {
+    if (text[end] === text[open]) {
+      let slashes = 0;
+      for (let i = end - 1; i > open && text[i] === "\\"; i--) slashes++;
+      if (slashes % modulus === depth) {
+        lastClosed = true;
+        return end + 1;
+      }
+    }
+    end++;
+  }
+  lastClosed = false;
+  return end;
+};
+const skipContainer = (text, open, limit = text.length) => {
+  const pending = [];
+  let end = open;
+  while (end < limit) {
+    const char = text[end];
+    if (isQuote(char)) {
+      let depth = 0;
+      while (text[end - 1 - depth] === "\\") depth++;
+      end = skipQuoted(text, end, depth, 2 * (depth + 1), limit);
+      if (!lastClosed) return end;
+      continue;
+    }
+    const closer = closers[char];
+    if (closer !== void 0) pending.push(closer);
+    else if (char === pending.at(-1)) {
+      pending.pop();
+      if (pending.length === 0) {
+        lastClosed = true;
+        return end + 1;
+      }
+    }
+    end++;
+  }
+  lastClosed = false;
+  return end;
+};
+const escapeDepth = (slashes) => (slashes ^ slashes + 1) >> 1;
+const innermostString = (stack) => stack.at(-1)?.string ?? -1;
+const track = (stack, text, from, to) => {
+  for (let i = from; i < to; i++) {
+    const char = text[i];
+    if (isQuote(char)) {
+      let slashes = 0;
+      while (text[i - 1 - slashes] === "\\") slashes++;
+      const inner = innermostString(stack);
+      if (inner === -1) {
+        stack.push({ close: char, depth: escapeDepth(slashes), string: stack.length });
+        continue;
+      }
+      if (stack[inner].close !== char) continue;
+      let closes = inner;
+      while (closes !== -1) {
+        const depth = stack[closes].depth;
+        if (slashes % (2 * (depth + 1)) === depth) break;
+        closes = closes === 0 ? -1 : stack[closes - 1].string;
+      }
+      if (closes === -1) stack.push({ close: char, depth: escapeDepth(slashes), string: stack.length });
+      else stack.length = closes;
+      continue;
+    }
+    const closer = closers[char];
+    if (closer !== void 0) stack.push({ close: closer, string: innermostString(stack) });
+    else if (stack.at(-1)?.depth === void 0 && char === stack.at(-1)?.close) stack.pop();
+  }
+};
+const closesEnclosing = (text, end, stack) => {
+  let at = end;
+  for (let k = stack.length - 1; k >= 0 && stack[k].depth === void 0 && text[at] === stack[k].close; k--) at++;
+  return at > end && /^(?:[\s,;"'`]|\\+["'`]|$)/.test(text.slice(at, at + 2));
+};
+const credentialWord = "(?:KEY|TOKEN|SECRET|PASSWORD|PASSPHRASE|CREDENTIAL)S?";
+const separator = (space) => String.raw`(?:\\*["'\x60])?${space}(?:=>|[=:])${space}`;
+const credentialName = String.raw`(?<![A-Za-z0-9_-])([A-Za-z0-9_-]*${credentialWord})`;
+const credentialNames = new RegExp(credentialName + separator("[ \\t]*"), "gi");
+const diagnosticNames = new RegExp(credentialName + separator(String.raw`\s*`), "gi");
+const authorizationName = "(?:proxy-)?authorization".replace(/[a-z]/g, (char) => `[${char}${char.toUpperCase()}]`);
+const headerWord = String.raw`${authorizationName}|${"(?:set-)?cookies?".replace(/[a-z]/g, (char) => `[${char}${char.toUpperCase()}]`)}`;
+const headerName = String.raw`(?<![A-Za-z0-9!#$%&*+.^_|~-])(?<![A-Za-z0-9!#$%&'*+.^_\x60|~-]['\x60])(${headerWord})`;
+const headerNames = new RegExp(
+  String.raw`((?:proxy-)?authorization|(?:set-)?cookies?)${separator(String.raw`\s*`)}`,
+  "gi"
+);
+const diagnosticHeaderNames = new RegExp(
+  // A trailing token quote requires an opener; double quotes are never token characters.
+  `${headerName}(?:` + String.raw`(?:(?<=["'\x60](?:${headerWord}))|(?!\\*['\x60]))${separator(String.raw`\s*`)}|` + String.raw`(?<=${authorizationName})\s+(?=(?:Token|TOKEN|[Bb]earer|BEARER|Basic|BASIC)[ \t]+\S))`,
+  "g"
+);
+const anyName = new RegExp(`${credentialNames.source}|${headerNames.source}`, "gi");
+const nameBefore = new RegExp(`(?:${credentialNames.source}|${headerNames.source})$`, "i");
+const nextName = (text, from, quoted) => {
+  const cached = nameSearches[quoted ? 1 : 0];
+  if (cached.text === text && from >= cached.from && from <= cached.found) return cached.found;
+  let found = text.length;
+  anyName.lastIndex = from;
+  for (let match = anyName.exec(text); match !== null; match = anyName.exec(text)) {
+    if (!quoted || isQuote(text[match.index - 1])) {
+      found = match.index;
+      break;
+    }
+  }
+  nameSearches[quoted ? 1 : 0] = { text, from, found };
+  return found;
+};
+const nameSearches = [{ text: "", from: 0, found: 0 }, { text: "", from: 0, found: 0 }];
+const lineEnd = (text, index) => {
+  if (lastLine.text === text && index >= lastLine.from && index <= lastLine.end) return lastLine.end;
+  newline.lastIndex = index;
+  const end = newline.exec(text)?.index ?? text.length;
+  lastLine = { text, from: index, end };
+  return end;
+};
+const newline = /[\r\n]/g;
+let lastLine = { text: "", from: 0, end: 0 };
+const continuesAcrossSpace = (text, start, end) => {
+  const run = text.slice(start, end);
+  let next = end;
+  while (text[next] === " " || text[next] === "	") next++;
+  if (run === "new") return next;
+  const prefix = /^[\w$.]+$/.test(run) || /[)\]>]$/.test(run);
+  return prefix && closers[text[next] ?? ""] !== void 0 ? next : void 0;
+};
+const separatesPairs = (text, end) => text[end] === "&" ? /^&[A-Za-z_][\w.-]*=/.test(text.slice(end, end + 64)) : /^[,;](?:\s|$|\s*\\*["'`]?[A-Za-z_][\w.-]*\\*["'`]?\s*(?:=>|[=:]))/.test(text.slice(end, end + 64));
+const containerWindow = 4096;
+const containerBudget = 4;
+const bareValueEnd = (text, start, scope, stack, budget) => {
+  const inner = stack[innermostString(stack)];
+  const bound = scope.diagnostic ? text.length : lineEnd(text, start);
+  const window = scope.diagnostic ? text.length : Math.min(text.length, start + Math.max(containerWindow, budget.remaining));
+  const unclosed = (open, end2) => Math.max(open, Math.min(end2, bound));
+  const container = (open) => {
+    if (scope.diagnostic) return skipContainer(text, open, window);
+    const end2 = skipContainer(text, open, bound);
+    if (lastClosed || !/[[{(,]\s*$/.test(text.slice(open, bound))) return end2;
+    const past = skipContainer(text, open, window);
+    budget.remaining -= past - open;
+    return past;
+  };
+  let end = start;
+  let limit = nextName(text, start + 1, scope.header);
+  if (scope.header && closers[text[start]] !== void 0) {
+    end = container(start);
+    if (!/^[^\s,;"'`\\)\]}]/.test(text[end] ?? " ")) return lastClosed ? end : unclosed(start, end);
+  }
+  while (end < text.length) {
+    if (end >= limit) {
+      if (end === limit) break;
+      limit = nextName(text, end, scope.header);
+      continue;
+    }
+    const char = text[end];
+    if (closers[char] !== void 0) {
+      const open = end;
+      end = container(open);
+      if (!lastClosed) return unclosed(open, end);
+      continue;
+    }
+    if (char === "<") {
+      angleClose.lastIndex = end;
+      const close = angleClose.exec(text)?.index;
+      if (close !== void 0 && text[close] === ">") {
+        end = close + 1;
+        continue;
+      }
+    }
+    let depth = 0;
+    while (text[end + depth] === "\\") depth++;
+    const quote = text[end + depth];
+    if (isQuote(quote)) {
+      const closesString = inner !== void 0 && quote === inner.close && depth % (2 * (inner.depth + 1)) <= inner.depth && !nameBefore.test(text.slice(Math.max(start, end - 256), end));
+      if (closesString || !scope.header && inner === void 0 && stack.length > 0) break;
+      if (depth === 0 && /\w/.test(text[end - 1] ?? "") && /\w/.test(text[end + 1] ?? "")) {
+        end++;
+        continue;
+      }
+      const open = end;
+      end = skipQuoted(text, end + depth, depth, 2 * (depth + 1), bound);
+      if (!lastClosed) return unclosed(open, end);
+      continue;
+    }
+    if (char === "\r" || char === "\n") break;
+    if (!scope.header && (char === "&" && separatesPairs(text, end) || (char === "," || char === ";") && (stack.length > 0 || separatesPairs(text, end)))) break;
+    if (!scope.header && !scope.diagnostic && (char === " " || char === "	")) {
+      const next = continuesAcrossSpace(text, start, end);
+      if (next === void 0) break;
+      end = next;
+      continue;
+    }
+    if (closesEnclosing(text, end, stack)) break;
+    end++;
+  }
+  while (end > start && /\s/.test(text[end - 1])) end--;
+  return end;
+};
+const plainKeyName = (name) => /keys?$/i.test(name) && !isSensitiveKey(name);
+const userinfoEnd = (text, start, end) => {
+  if (!/\/\/[^\s/@?#]*[:=]$/.test(text.slice(Math.max(0, start - 128), start))) return end;
+  const value = text.slice(start, end);
+  const authority = value.search(/[/?#]/);
+  const at = value.lastIndexOf("@", authority < 0 ? value.length : authority);
+  return at > 0 ? start + at : end;
+};
+const namesCredential = (name, value) => !plainKeyName(name) && !(/tokens$/i.test(name) && /^["'`]?\d+(?![\w.])/.test(value));
+const angleClose = /[>\r\n]/g;
+const continuation = /(?:\s|\\+[nrt])*\+(?:\s|\\+[nrt])*/y;
+const alreadyRedacted = /^\[REDACTED\]$/;
+const redactValues = (text, names, scope) => {
+  const keys = new RegExp(names.source, names.flags);
+  let output = "";
+  let position = 0;
+  const stack = [];
+  const budget = { remaining: containerBudget * text.length };
+  let scanned = 0;
+  for (let match = keys.exec(text); match !== null; match = keys.exec(text)) {
+    const name = match[1];
+    if (!scope.header && plainKeyName(name)) continue;
+    track(stack, text, scanned, keys.lastIndex);
+    scanned = keys.lastIndex;
+    let start = keys.lastIndex;
+    let depth = 0;
+    while (text[start + depth] === "\\") depth++;
+    const opener = text[start + depth];
+    const quote = isQuote(opener) ? opener : void 0;
+    let end;
+    if (quote !== void 0) {
+      start += depth;
+      const inner = stack[innermostString(stack)];
+      if (inner !== void 0) {
+        end = skipQuoted(text, start, depth, (inner.close === quote ? 1 : 2 * (inner.depth + 1)) * 2 * (depth + 1));
+      } else {
+        const undoubled = skipQuoted(text, start, depth);
+        end = skipQuoted(text, start, depth, Math.max(4, 2 * (depth + 1)));
+        const next = nextName(text, undoubled, false);
+        if (next < end) end = /^[\s,;&]*$/.test(text.slice(undoubled, next)) ? undoubled : next;
+      }
+      const closed2 = end - start > 1 && text[end - 1] === quote;
+      if (!closed2 && !scope.diagnostic) end = Math.min(end, lineEnd(text, start));
+      if (depth === 0) {
+        for (continuation.lastIndex = end; continuation.test(text); continuation.lastIndex = end) {
+          const piece = continuation.lastIndex;
+          if (!isQuote(text[piece])) break;
+          end = skipQuoted(text, piece, 0);
+        }
+      }
+      if (alreadyRedacted.test(text.slice(start + 1, end - (text[end - 1] === quote ? 1 + depth : 0)))) continue;
+    } else {
+      end = bareValueEnd(text, start, scope, stack, budget);
+      end = userinfoEnd(text, start, end);
+      const bounded = !scope.diagnostic && text.startsWith(placeholder, start) && /\s/.test(text[start + placeholder.length] ?? "");
+      const kept = end === start || bounded || alreadyRedacted.test(text.slice(start, end)) || /tokens$/i.test(name) && /^\d+(?![\w.])/.test(text.slice(start, end)) || // A Bearer or Basic value the default rules already replaced keeps its scheme.
+      scope.header && /^(?:bearer|basic)\s+\[REDACTED/i.test(text.slice(start, start + 24));
+      if (kept) continue;
+    }
+    const escape = quote === void 0 ? "" : "\\".repeat(depth);
+    const closed = quote !== void 0 && end - start > 1 && text[end - 1] === quote;
+    output += text.slice(position, keys.lastIndex) + escape + (quote ?? "") + placeholder + (closed ? escape + quote : "");
+    position = end;
+    scanned = end;
+    keys.lastIndex = end;
+  }
+  return output + text.slice(position);
+};
+const argumentSeparator = String.raw`(?:\s+|["'\x60]\s*,\s*["'\x60])`;
+const credentialFlag = new RegExp(
+  String.raw`(?<![A-Za-z0-9_-])(--?[A-Za-z0-9_-]*${credentialWord})${argumentSeparator}`,
+  "gi"
+);
+const shortPasswordFlag = new RegExp(
+  String.raw`(?<![^\s"'\x60,[(])-p${argumentSeparator}(?!(?:\.{0,2}|~)\/|--)`,
+  "g"
+);
+const passwordFlag = new RegExp(
+  String.raw`(?<![^\s"'\x60,[(])-p(?:w|ass(?:in|out|wd)?)${argumentSeparator}`,
+  "g"
+);
+const attachedPasswordFlag = new RegExp(
+  String.raw`(?<![^\s"'\x60,[(])-p(?!(?:rint\w*|rune|erm|ath|threads?|edantic[\w-]*|ipe|ie|g|retty|lain|rogress|rofile|arents|reserve|ass(?:in|out|wd)?|w)(?![^\s"'\x60,\]]))(?=[^\s,\]])`,
+  "g"
+);
+const userFlag = new RegExp(
+  String.raw`(?<![^\s"'\x60,[(])(?:(?:-u|--user)(?:=|${argumentSeparator})|-u(?=[^\s=-]))`,
+  "g"
+);
+const commandPasswordFlag = new RegExp(
+  String.raw`\b(?:(?:(?:un)?zip|zipcloak)\b[^\r\n|;&]{0,256}?[\s"'\x60,[(]-P|redis-cli\b[^\r\n|;&]{0,256}?[\s"'\x60,[(](?:-a|--pass))${argumentSeparator}`,
+  "g"
+);
+const headerPair = /(?<![A-Za-z0-9_-])(?:(?:proxy-)?authorization|(?:set-)?cookies?)\\*["'`]\s*,\s*(?=\\*["'`])/gi;
+const redactHeaderPairs = (text) => {
+  const pattern = new RegExp(headerPair.source, headerPair.flags);
+  let output = "";
+  let position = 0;
+  for (let match = pattern.exec(text); match !== null; match = pattern.exec(text)) {
+    let depth = 0;
+    while (text[pattern.lastIndex + depth] === "\\") depth++;
+    const open = pattern.lastIndex + depth;
+    const end = skipQuoted(text, open, depth);
+    const close = lastClosed ? end - 1 - depth : end;
+    if (alreadyRedacted.test(text.slice(open + 1, close))) continue;
+    output += text.slice(position, open + 1) + placeholder;
+    position = close;
+    pattern.lastIndex = end;
+  }
+  return output + text.slice(position);
+};
+const redactedArgument = /^(?:\\*(["'`]))?\[REDACTED\](?:\\*\1)?$/;
+const wordEnd = (text, start) => {
+  let end = start;
+  while (end < text.length && !/\s/.test(text[end])) {
+    const quote = text[end];
+    if (!isQuote(quote)) {
+      end++;
+      continue;
+    }
+    let close = end + 1;
+    while (close < text.length && !/[\s"'`,:{}[\]]/.test(text[close])) close++;
+    if (close === end + 1 || text[close] !== quote) break;
+    end = close + 1;
+  }
+  return end;
+};
+const redactArguments = (text, flags, accept) => {
+  const pattern = new RegExp(flags.source, flags.flags);
+  let output = "";
+  let position = 0;
+  for (let match = pattern.exec(text); match !== null; match = pattern.exec(text)) {
+    const start = pattern.lastIndex;
+    let depth = 0;
+    while (text[start + depth] === "\\") depth++;
+    let end = start;
+    if (isQuote(text[start + depth])) end = skipQuoted(text, start + depth, depth);
+    else end = wordEnd(text, start);
+    const value = text.slice(start, end);
+    if (end === start || redactedArgument.test(value) || accept?.(match, value) === false) continue;
+    output += text.slice(position, start) + placeholder;
+    position = end;
+    pattern.lastIndex = end;
+  }
+  return output + text.slice(position);
+};
+const durable = { header: false, diagnostic: false };
+const defaultRules = [
+  {
+    id: "private-key-block",
+    // Stop an unterminated block at the next header so repeated headers cannot
+    // each rescan the remaining input. A valid PEM body contains no headers.
+    // A block with no footer is a key a bound or a producer truncated, and its
+    // body is as secret as a whole one's, so it runs to the next header or to
+    // the end of the text. It runs first: a block inside URL userinfo, once
+    // replaced, is userinfo the URL rule then reads whole, so a second pass
+    // finds nothing left to change.
+    pattern: /-----BEGIN[^-]*PRIVATE KEY(?: BLOCK)?-----(?:(?!-----BEGIN)[\s\S])*?(?:-----END[^-]*-----|(?=-----BEGIN)|$)/g
+  },
+  // Git HTTPS OAuth credentials place the secret in the username. Match
+  // before password rewriting removes the x-oauth-basic marker.
+  {
+    id: "git-oauth-userinfo",
+    pattern: /(https?:\/\/)[^\s/@:"'\\]+:x-oauth-basic@/gi,
+    replace: "$1[REDACTED]@"
+  },
+  {
+    id: "url-credentials",
+    // The scheme is bounded rather than open. `-` is not a word character, so
+    // `\b[a-z][a-z0-9+.-]*` starts a fresh scan after every hyphen, and on a
+    // long run of that shape the rule rescanned the tail from each one: 400 kB
+    // of `aaaaaaaa-` cost 11 seconds, on the path every journal write and every
+    // log line takes. A scheme longer than 30 characters is not one this net is
+    // for, and the cap makes each start position cost a constant.
+    pattern: /\b([a-z][a-z0-9+.-]{0,30}:\/\/[^\s:@/]+):(?!\[REDACTED\]@)[^\s:@/]+@/gi,
+    replace: "$1:[REDACTED]@"
+  },
+  {
+    id: "bearer-token",
+    pattern: /\bBearer\s+[A-Za-z0-9._~+/-]{4,}=*/gi,
+    replace: "Bearer [REDACTED_TOKEN]"
+  },
+  {
+    id: "basic-authorization",
+    pattern: /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}/gi,
+    replace: "Basic [REDACTED_TOKEN]"
+  },
+  {
+    id: "jwt",
+    // Check the three segments once per token before looking for a header.
+    // Starting at every `-eyJ` would rescan a malformed token's entire tail.
+    // Preserve any prefix so a JWT following a hyphen still gets redacted.
+    pattern: /(?<![A-Za-z0-9_-])(?=[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-])([A-Za-z0-9_-]*?)\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+    replace: "$1[REDACTED_TOKEN]"
+  },
+  {
+    id: "api-key",
+    // Not `\b`, for the reason the assignment rule below gives: an underscore
+    // is a word character, so `\bsk` never fires after `ANTHROPIC_` or after
+    // Effect's log-span sanitizer folds `token=` into `token_`. The lookbehind
+    // excludes only letters and digits, so a key still reads as a key when an
+    // underscore or a hyphen runs into it.
+    pattern: /(?<![A-Za-z0-9])(?:sk|pk)[-_][A-Za-z0-9][A-Za-z0-9_-]{7,}/g,
+    replace: "[REDACTED_API_KEY]"
+  },
+  {
+    id: "github-token",
+    pattern: /\bgh[pousr]_[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+    replace: "[REDACTED]"
+  },
+  {
+    id: "github-fine-grained-token",
+    pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}(?![A-Za-z0-9_])/g,
+    replace: "[REDACTED]"
+  },
+  {
+    id: "aws-access-key",
+    pattern: /\bAKIA[0-9A-Z]{16}\b/g,
+    replace: "[REDACTED]"
+  },
+  {
+    id: "slack-token",
+    pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g,
+    replace: "[REDACTED]"
+  },
+  {
+    id: "google-api-key",
+    pattern: /\bAIza[0-9A-Za-z_-]{35,}(?![0-9A-Za-z_-])/g,
+    replace: "[REDACTED]"
+  },
+  {
+    id: "assignment",
+    // A credential name, `:`, `=` or `=>`, and its whole value: quoted at any
+    // escape depth, a container, or several bare words. See `redactValues`.
+    pattern: credentialNames,
+    rewrite: (text) => redactValues(text, credentialNames, durable)
+  },
+  {
+    id: "credential-flag",
+    // `--password hunter2`, `--api-key "a b"`, or the same pair as two argv
+    // elements. `--token=x` is an assignment above; this is the spelling a
+    // command line separates with a space. The next word is the value even
+    // when it starts with `-`: a credential flag always takes one.
+    pattern: credentialFlag,
+    rewrite: (text) => redactArguments(text, credentialFlag, (match, value) => namesCredential(match[1].replace(/^-+/, ""), value))
+  },
+  {
+    id: "cookie-session-assignment",
+    pattern: /(?<![A-Za-z0-9-])((?:COOKIE|SESSION)S?)(\s*=\s*)(?!\[REDACTED\])("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|(?!["'])[^\s;,]+)/gi,
+    replace: "$1$2[REDACTED]"
+  }
+];
+const diagnosticRules = [
+  ...defaultRules.map(
+    (rule) => rule.id === "assignment" ? {
+      id: "assignment",
+      pattern: diagnosticNames,
+      rewrite: (text) => redactValues(text, diagnosticNames, { header: false, diagnostic: true })
+    } : rule
+  ),
+  {
+    id: "authorization-header",
+    // The header value is a credential whatever its scheme (`Token`, a cookie
+    // list, `Digest` with quoted parameters), so the value runs to the end of
+    // its line or the close of the string it was written in.
+    // A lookbehind-free superset lets the compiled prefilter skip ordinary prose.
+    pattern: /(?:proxy-)?authorization|(?:set-)?cookies?/gi,
+    rewrite: (text) => redactValues(text, diagnosticHeaderNames, { header: true, diagnostic: true })
+  },
+  {
+    id: "bearer-or-basic",
+    // A token shorter than the default rules' minimum. A lowercase `basic` is
+    // prose ("a basic example"), so only the scheme's own spellings count.
+    pattern: /(\b(?:[Bb]earer|BEARER|Basic|BASIC)\s+)(?!\[REDACTED)[^\s,;"'\\]+/g,
+    replace: "$1[REDACTED]"
+  },
+  {
+    id: "password-flag",
+    // The whole next argument, a path or a leading `-` included.
+    pattern: passwordFlag,
+    rewrite: (text) => redactArguments(text, passwordFlag)
+  },
+  {
+    id: "sshpass-password",
+    // `sshpass -p` always takes a value, even one that starts with `--`,
+    // which `mysql -p --database x` reads as the next option.
+    pattern: /(\bsshpass(?:\s+-[^\sp]\S*){0,8}\s+-p\s+)--(?!\[REDACTED\])[^\s"'`]*/g,
+    replace: "$1[REDACTED]"
+  },
+  {
+    id: "user-flag",
+    // `curl -u user:pass`, `--user=user:pass`, quoted or not: the whole
+    // argument, commas included, when it carries a `:`.
+    pattern: userFlag,
+    rewrite: (text) => redactArguments(text, userFlag, (_match, value) => value.includes(":"))
+  },
+  {
+    id: "header-pair",
+    pattern: headerPair,
+    rewrite: redactHeaderPairs
+  },
+  {
+    id: "command-password-flag",
+    // The whole next argument, whatever it starts with.
+    pattern: commandPasswordFlag,
+    rewrite: (text) => redactArguments(text, commandPasswordFlag)
+  },
+  {
+    id: "url-userinfo",
+    pattern: /(\/\/)(?!\[REDACTED\]@)(?![^/@\s"'\\]*:\[REDACTED\]@)[^/@\s"'\\]+@/g,
+    replace: "$1[REDACTED]@"
+  },
+  {
+    id: "signed-query",
+    pattern: /([?&][\w.-]*(?:key|sig|signature|auth|credential)=)(?!\[REDACTED\])[^&#\s"'\\]+/gi,
+    replace: "$1[REDACTED]"
+  },
+  {
+    id: "short-password-flag",
+    // A path is kept, and so is a flag: `mysql -p --database x` prompts for
+    // the password rather than taking one.
+    pattern: shortPasswordFlag,
+    rewrite: (text) => redactArguments(text, shortPasswordFlag)
+  },
+  {
+    id: "attached-password-flag",
+    // `-psecret`. The single-dash words that start with `p` and are not a
+    // password, `find -print` and the compilers' `-pthread` among them, are kept.
+    pattern: attachedPasswordFlag,
+    rewrite: (text) => redactArguments(text, attachedPasswordFlag)
+  }
+];
+const redactDiagnostic = (value) => redact(value, { rules: diagnosticRules, onTooDeep: "name" });
+const sensitiveKeySuffixes = [
+  "auth",
+  "authorization",
+  "cookie",
+  "apikey",
+  "token",
+  "password",
+  "passphrase",
+  "secret",
+  "secretaccesskey",
+  "credential",
+  "dsn",
+  "connection",
+  "connectionstring",
+  "connectionuri",
+  "connectionurl",
+  "secretkey",
+  "privatekey",
+  "sshkey",
+  "signingkey",
+  "signature",
+  "encryptionkey",
+  "session",
+  "sessionkey"
+];
+const trailingKeyWord = /(?:^|[^A-Za-z0-9])key$/i;
+const canonicalKey = (key) => key.toLowerCase().replace(/[^a-z0-9]/g, "").replace(/s$/, "");
+const tokenCounterKeys = /* @__PURE__ */ new Set([
+  "inputtoken",
+  "outputtoken",
+  "cachedinputtoken",
+  "reasoningtoken",
+  "totaltoken"
+]);
+const isTokenCount = (key, value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && (tokenCounterKeys.has(canonicalKey(key)) || key.toLowerCase() === "tokens");
+const isSensitiveKey = (key) => {
+  if (trailingKeyWord.test(key)) return true;
+  const canonical = canonicalKey(key);
+  return sensitiveKeySuffixes.some((suffix) => canonical.endsWith(suffix));
+};
+const redactMember = (key, value, walk) => isSensitiveKey(key) && !isTokenCount(key, value) ? placeholder : walk(value);
+const redactKey = (key, rules) => {
+  const redacted = redactString(key, rules);
+  return redacted === key ? key : placeholder;
+};
+const fixedPointPasses = 8;
+const candidate = (pattern) => {
+  const cached = candidates.get(pattern);
+  if (cached !== void 0) return cached;
+  const leading = /^\(\?<!\[(\^?)((?:\\.|[^\]\\])*)\]\)/.exec(pattern.source);
+  const rest = leading === null ? pattern.source : pattern.source.slice(leading[0].length);
+  const compiled = /\(\?<[!=]|\\(?:[1-9]|k<)/.test(rest) ? null : new RegExp(
+    leading === null ? rest : `(?:^|[${leading[1] === "" ? "^" : ""}${leading[2]}])${rest}`,
+    pattern.flags.replace(/[gy]/g, "")
+  );
+  candidates.set(pattern, compiled);
+  return compiled;
+};
+const candidates = /* @__PURE__ */ new WeakMap();
+const applyRule = (text, rule) => {
+  if (candidate(rule.pattern)?.test(text) === false) return text;
+  return rule.rewrite === void 0 ? text.replace(rule.pattern, rule.replace ?? placeholder) : rule.rewrite(text);
+};
+const redactString = (value, rules) => {
+  let text = value;
+  for (let pass = 0; pass < fixedPointPasses; pass++) {
+    const next = rules.reduce(applyRule, text);
+    if (next === text) return text;
+    text = next;
+  }
+  return placeholder;
+};
+const maxDepth = 256;
+class RedactionDepthError extends Schema.TaggedError()(
+  "@smthrs/journal/RedactionDepthError",
+  { code: Schema.Literal("depth_exceeded"), maxDepth: Schema.Number, message: Schema.String }
+) {
+  name = "RedactionDepthError";
+}
+const binaryWalkLimit = 65536;
+const byteLengthGetters = [
+  Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), "byteLength").get,
+  Object.getOwnPropertyDescriptor(DataView.prototype, "byteLength").get,
+  Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength").get
+];
+const byteLength = (node) => {
+  for (const getter of byteLengthGetters) {
+    try {
+      return Reflect.apply(getter, node, []);
+    } catch {
+    }
+  }
+  return void 0;
+};
+const binaryPrototypes = /* @__PURE__ */ new Set([
+  Object.getPrototypeOf(Uint8Array.prototype),
+  DataView.prototype,
+  ArrayBuffer.prototype
+]);
+const prototypeWalkLimit = 64;
+const isBinary = (node) => {
+  if (ArrayBuffer.isView(node) || node instanceof ArrayBuffer) return true;
+  try {
+    let prototype = Object.getPrototypeOf(node);
+    for (let step = 0; prototype !== null && step < prototypeWalkLimit; step++) {
+      if (binaryPrototypes.has(prototype)) return true;
+      prototype = Object.getPrototypeOf(prototype);
+    }
+  } catch {
+  }
+  return false;
+};
+const indexKey = /^(?:0|[1-9][0-9]*)$/;
+const describeBinary = (node, size) => {
+  if (size === void 0) return binaryMarker;
+  try {
+    return `${node.constructor.name} ${size} bytes`;
+  } catch {
+    return binaryMarker;
+  }
+};
+const binaryMarker = "[Binary]";
+const functionMarker = "[Function]";
+const symbolMarker = "[Symbol]";
+const depthMarker = "[Deep]";
+const redact = (value, options) => {
+  const onTooDeep = options?.onTooDeep ?? "throw";
+  const rules = globalRules(options?.rules ?? defaultRules);
+  const binary = (node, ancestors, depth) => {
+    const size = byteLength(node);
+    const entries = [[binaryMarker, redactString(describeBinary(node, size), rules)]];
+    if (size !== void 0 && size <= binaryWalkLimit) {
+      let walked = 0;
+      for (const [key, field] of Object.entries(node)) {
+        if (indexKey.test(key)) continue;
+        if (walked >= binaryWalkLimit) break;
+        walked++;
+        entries.push([
+          redactKey(key, rules),
+          redactMember(key, field, (value2) => walk(value2, ancestors, depth + 1, key))
+        ]);
+      }
+    }
+    return Object.fromEntries(entries);
+  };
+  const walk = (node, ancestors, depth, key) => {
+    if (depth > maxDepth) {
+      if (onTooDeep === "name") return depthMarker;
+      throw new RedactionDepthError({
+        code: "depth_exceeded",
+        maxDepth,
+        message: `redaction depth exceeds ${maxDepth}`
+      });
+    }
+    if (typeof node === "string") return redactString(node, rules);
+    if (typeof node === "function") return functionMarker;
+    if (typeof node === "symbol") return symbolMarker;
+    if (node === null || typeof node !== "object") return node;
+    if (isBinary(node)) return binary(node, ancestors, depth);
+    if (ancestors.has(node)) return "[Circular]";
+    ancestors.add(node);
+    try {
+      const toJSON = node.toJSON;
+      if (typeof toJSON === "function") return walk(toJSON.call(node, key), ancestors, depth, key);
+      if (Array.isArray(node)) {
+        const length = node.length;
+        const result = new Array(length);
+        const elements = new Array(length);
+        for (let index = 0; index < length; index++) {
+          if (!(index in node)) continue;
+          elements[index] = node[index];
+          result[index] = walk(elements[index], ancestors, depth + 1, String(index));
+        }
+        for (let index = 0; index + 1 < length; index++) {
+          const flag = elements[index];
+          const value2 = elements[index + 1];
+          if (typeof flag !== "string" || typeof value2 !== "string" || !/^-[^=\s]+$/.test(flag)) continue;
+          const name = flag.replace(/^-+/, "");
+          const before = elements.slice(Math.max(0, index - 3), index + 1).filter(
+            (element) => typeof element === "string"
+          ).join(" ");
+          const consumes = isSensitiveKey(name) && namesCredential(name, value2) || redactString(`${before} ${value2}`, rules) !== `${redactString(before, rules)} ${redactString(value2, rules)}`;
+          if (consumes) result[index + 1] = placeholder;
+        }
+        return result;
+      }
+      return Object.fromEntries(
+        Object.entries(node).map(([key2, field]) => [
+          // The KEY is text too. Rewriting only values let a credential used as
+          // a log annotation key reach the operator, since Effect renders an
+          // annotation as `key=value`, and become an OTLP span attribute name.
+          redactKey(key2, rules),
+          redactMember(key2, field, (value2) => walk(value2, ancestors, depth + 1, key2))
+        ])
+      );
+    } finally {
+      ancestors.delete(node);
+    }
+  };
+  return walk(value, /* @__PURE__ */ new WeakSet(), 0, "");
+};
+const make = (options) => (value) => redact(value, options);
+const redactJsonString = (json, redactor) => {
+  const decoded = Schema.decodeUnknownResult(UnknownFromJsonString)(json);
+  if (Result.isFailure(decoded)) return json;
+  const attempted = Result.try(() => Schema.encodeUnknownResult(UnknownFromJsonString)(redactor(decoded.success)));
+  if (Result.isFailure(attempted)) return JSON.stringify(placeholder);
+  return Result.isSuccess(attempted.success) ? attempted.success.success : JSON.stringify(placeholder);
+};
+const maxHeldLines = 256;
+const maxHeldBytes = 64 * 1024;
+const eagerHeldLines = 16;
+const maxDroppedDepth = 1024;
+const maxPartialLine = 32 * 1024;
+const omittedLine = "[overlong line omitted]";
+const continuationProbe = "\n'probe'";
+const globalRules = (rules) => rules.map(
+  (rule) => rule.pattern.flags.includes("g") ? rule : { ...rule, pattern: new RegExp(rule.pattern.source, `${rule.pattern.flags}g`) }
+);
+const lineRedactor = (rules = diagnosticRules) => {
+  const held = [];
+  let heldBytes = 0;
+  let askAt = 0;
+  let heldOverlong = false;
+  let withheld = false;
+  const edge = maxPartialLine / 2;
+  let head = "";
+  let tail = "";
+  let overlong = false;
+  let middle = [];
+  let middleDeep = false;
+  let middleKey = false;
+  let carry = "";
+  const resetPartial = () => {
+    head = "";
+    tail = "";
+    overlong = false;
+    middle = [];
+    middleDeep = false;
+    middleKey = false;
+    carry = "";
+  };
+  const scanDropped = (dropped) => {
+    for (let from = 0; from < dropped.length && !middleDeep; from += edge) {
+      track(middle, dropped, from, Math.min(dropped.length, from + edge));
+      if (middle.length > maxDroppedDepth) {
+        middleDeep = true;
+        middle = [];
+      }
+    }
+    const seen = carry + dropped;
+    const begin = seen.search(/-----BEGIN[^-]*PRIVATE KEY/);
+    const lastBegin = seen.lastIndexOf("-----BEGIN");
+    const lastEnd = seen.lastIndexOf("-----END");
+    if (begin !== -1 || lastEnd !== -1) middleKey = lastBegin > lastEnd;
+    carry = seen.slice(-64);
+  };
+  const redacted = (text) => redactString(text, globalRules(rules));
+  const release = () => {
+    const text = redacted(held.join("\n"));
+    const overlongBlock = heldOverlong;
+    held.length = 0;
+    heldBytes = 0;
+    askAt = 0;
+    heldOverlong = false;
+    return overlongBlock ? [omittedLine] : text.split("\n");
+  };
+  const part = (text) => {
+    if (withheld) return;
+    if (!overlong) {
+      head += text;
+      if (head.length <= maxPartialLine) return;
+      overlong = true;
+      tail = head.slice(edge);
+      head = head.slice(0, edge);
+    } else tail += text;
+    if (tail.length > edge) {
+      scanDropped(tail.slice(0, tail.length - edge));
+      tail = tail.slice(-edge);
+    }
+  };
+  const line = (rest) => {
+    if (withheld) {
+      resetPartial();
+      return [];
+    }
+    part(rest);
+    let text = head;
+    if (overlong) {
+      const risky = middle.length > 0 || middleDeep || middleKey;
+      text = `${head} ${tail}`;
+      resetPartial();
+      if (risky) {
+        const before = held.length === 0 ? [] : [placeholder];
+        held.length = 0;
+        heldBytes = 0;
+        askAt = 0;
+        heldOverlong = false;
+        withheld = true;
+        return [...before, omittedLine];
+      }
+      heldOverlong = true;
+    } else resetPartial();
+    held.push(text);
+    heldBytes += text.length + 1;
+    if (held.length <= eagerHeldLines || heldBytes >= askAt) {
+      if (redacted(held.join("\n") + continuationProbe).endsWith(continuationProbe)) return release();
+      askAt = heldBytes + (heldBytes >> 1);
+    }
+    if (held.length <= maxHeldLines && heldBytes <= maxHeldBytes) return [];
+    withheld = true;
+    return release();
+  };
+  const peek = () => {
+    if (withheld) return [placeholder];
+    const pending = overlong ? [omittedLine] : head === "" ? [] : [head];
+    if (heldOverlong) return [omittedLine];
+    const text = [...held, ...overlong ? [] : pending];
+    const out = text.length === 0 ? [] : redacted(text.join("\n")).split("\n");
+    return overlong ? [...out, omittedLine] : out;
+  };
+  return {
+    line,
+    part,
+    peek,
+    flush: () => {
+      const out = head !== "" || overlong ? [...line("")] : [];
+      if (withheld) {
+        withheld = false;
+        return [...out, placeholder];
+      }
+      return held.length === 0 ? out : [...out, ...release()];
+    }
+  };
+};
+const makeNoop = () => (value) => value;
+//# sourceMappingURL=Redaction.js.map