@smthrs/journal 0.0.0-stage → 1.0.0-rc.3

package/dist/esm/RedactedLogger.js

@@ -0,0 +1,445 @@
+/**
+ * The redacting logger: the journal's redaction rules applied to log output.
+ *
+ * The journal redacts on the write path, so a credential a cell logs or
+ * returns never reaches a committed row (`./Redaction.ts`). The operator's
+ * terminal was the other place the same credential surfaces: every built-in
+ * Effect logger renders through the fiber's `Console`, so an action that hands
+ * a token to `Effect.logInfo` wrote it to stderr in full and it reached
+ * whatever collected that stream.
+ *
+ * This module closes that half with the SAME rules rather than a second rule
+ * set. {@link wrap} does not re-implement redaction and does not re-format a
+ * log line. It redacts the log event itself — the message, the cause, and the
+ * log annotations — before the wrapped logger is handed it, and it hands that
+ * logger a view of the fiber whose `Console` is a redacting console, so
+ * whatever the logger renders for itself — a pretty line, a JSON document —
+ * passes through `Redaction.redact` on its way to the stream as well.
+ *
+ * Both halves carry load. Most built-in loggers write through the fiber's
+ * `Console`, which is what covers the pretty line, the `--json` document, and
+ * the `.flows/logs/<runId>.log` stream. But a logger is free to read the event
+ * instead of rendering it, and one in Effect's own default logger set does:
+ * `Logger.tracerLogger` publishes the message as a span event name and
+ * `Cause.pretty` of the cause as the span's `effect.cause` attribute, and
+ * never reads `Console` at all. Redacting only the console would hide a
+ * credential on stderr and export it in clear to whatever OTLP collector is
+ * configured.
+ *
+ * Cost is bounded by the rules themselves: every alternation inside a
+ * repetition in `Redaction.diagnosticRules` starts its branches with disjoint
+ * characters, so each rule is linear in the length of the line and no input
+ * backtracks catastrophically.
+ *
+ * One deliberate difference from the journal write path. `Redaction.redact`
+ * rebuilds an object from its own enumerable entries, which is right for a row
+ * that is about to be JSON-encoded and wrong for a terminal: an `Error` keeps
+ * `message` and `stack` on non-enumerable properties, so rebuilding one prints
+ * `{}` where the operator expected a failure. An `Error` is rebuilt as a plain
+ * `Error` instead, carrying its name, message, stack and own members with the
+ * rules applied. Its class is NOT preserved. A copy built on the original's
+ * prototype inherits everything the prototype defines, an own-key walk sees
+ * none of it, and each of `name`, `cause`, `toJSON`, `Symbol.toStringTag` and
+ * `nodejs.util.inspect.custom` carried a credential out that way.
+ *
+ * @since 0.1.0
+ */
+import * as Cause from "effect/Cause";
+import * as Console from "effect/Console";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as References from "effect/References";
+import * as Redaction from "./Redaction.js";
+/**
+ * Marks a logger this module already wrapped.
+ *
+ * Both the CLI and the durable runtime install {@link layer}, and a detached
+ * `smithers run` is both at once. Wrapping twice would be correct but pay the
+ * rules twice per line, so a wrapped logger is returned unchanged.
+ *
+ * @since 0.1.0
+ * @category type ids
+ */
+export const TypeId = Symbol.for("@smthrs/journal/RedactedLogger");
+/**
+ * Whether {@link wrap} already wrapped this logger.
+ *
+ * @since 0.1.0
+ * @category predicates
+ */
+export const isRedacted = (logger) => TypeId in logger;
+/**
+ * Console methods that write caller-supplied values, mapped to whether their
+ * arguments carry log output.
+ *
+ * Only `clear` and `groupEnd` are marked `false`, because those two take no
+ * arguments at all: there is nothing for the rules to read and binding them
+ * straight through saves a copy per call. Every other method here, `count`,
+ * `countReset`, `time`, and `timeEnd` included, accepts a caller-supplied
+ * LABEL and prints it, so a label of `api_key=sk-…` reached the terminal
+ * through all four of them. `timeLog` already redacted its label, so the pair
+ * `time` / `timeLog` also disagreed about what a timer is called; redacting all
+ * of them is what makes a label match itself again.
+ */
+const consoleMethods = {
+    assert: true,
+    clear: false,
+    count: true,
+    countReset: true,
+    debug: true,
+    dir: true,
+    dirxml: true,
+    error: true,
+    group: true,
+    groupCollapsed: true,
+    groupEnd: false,
+    info: true,
+    log: true,
+    table: true,
+    time: true,
+    timeEnd: true,
+    timeLog: true,
+    trace: true,
+    warn: true
+};
+/** How deep the logger walks a value before it names it instead. */
+const renderDepthLimit = 200;
+/** What the logger renders in place of a value nested past the depth limit. */
+const renderDepthMarker = "[Deep]";
+/**
+ * The parts of a log message.
+ *
+ * Effect's logging API passes an array, one entry per argument, including for
+ * a single argument. A caller that builds `LogOptions` by hand may pass the
+ * message itself, so it is wrapped rather than walked.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+const toArray = (message) => Array.isArray(message) ? message : [message];
+/**
+ * Reads one piece of text off `error` and runs it through the rules.
+ *
+ * Everything a renderer prints about an error is read here, once, and only the
+ * redacted result crosses to the copy. A caller's error can define any of these
+ * as an accessor that throws, and reading one happens while a log line is
+ * rendering, so a refusal costs that piece of text and nothing else.
+ */
+const redactedText = (read, redactor, fallback) => {
+    try {
+        return String(redactor(String(read())));
+    }
+    catch {
+        return fallback;
+    }
+};
+/** `error.stack` through the rules, or `undefined` when it has none to give. */
+const redactedStack = (error, redactor) => {
+    try {
+        const stack = error.stack;
+        // An `Error.stack` is optional. Under `exactOptionalPropertyTypes` an
+        // assignment cannot carry the `undefined` a stackless error has, so the
+        // copy defines the property instead of assigning it.
+        return typeof stack === "string" ? String(redactor(stack)) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * A member NAME with the rules applied, replaced outright when one fires.
+ *
+ * The treatment `Redaction.redact` gives an object key, for the same reason: a
+ * name is text a renderer prints. Rewriting one in place would change what it
+ * reads as and redaction would stop being a fixed point, so a name that matches
+ * becomes the placeholder whole.
+ */
+const redactedName = (key, redactor) => {
+    const redacted = String(redactor(key));
+    return redacted === key ? key : Redaction.placeholder;
+};
+/**
+ * Own names the copy never carries, because a renderer CALLS them.
+ *
+ * `name`, `message` and `stack` are defined from the rules above instead. The
+ * rest are hooks: a redacted `toString` or `valueOf` would leave a string under
+ * a name the language calls, and `String(error)` would then throw from inside
+ * the renderer, which is the failure mode this module exists to avoid.
+ */
+const renderHooks = new Set([
+    "constructor",
+    "message",
+    "name",
+    "stack",
+    "toJSON",
+    "toString",
+    "valueOf"
+]);
+/**
+ * A copy of `error` carrying the same information with the rules applied.
+ *
+ * A PLAIN `Error`, never a copy built on the original's prototype. A prototype
+ * is an unbounded leak surface and an own-key walk never looks at one: an
+ * inherited `name`, `cause`, `toJSON`, `Symbol.toStringTag` or
+ * `nodejs.util.inspect.custom` each carried a credential straight to an OTLP
+ * span attribute or to the operator's terminal, one per review round, and a
+ * getter anywhere on the chain is the same hole with a different name. So
+ * nothing inherited crosses. Only redacted text does: the name, the message,
+ * the stack, and the error's own members, each read once here and stored as
+ * data, since a getter carried across unchanged would hand the unredacted
+ * value to whatever reads it next.
+ *
+ * The copy is not an instance of the original's class, so a renderer that
+ * special-cases `instanceof MyError` sees a plain `Error`. That is the fidelity
+ * trade the release policy already records for every other value, and it is
+ * the trade the same problem's earlier, crashing form was settled with: a copy
+ * on a host prototype, such as the `DOMException` an `AbortSignal` carries as
+ * its reason, is an impostor whose brand check throws from inside `Cause.pretty`
+ * and kills the run the line was describing.
+ */
+const redactError = (error, redactor, seen, depth = 0) => {
+    // The memo holds the COPY, not a visited mark: returning the original on a
+    // repeat reference put the unredacted error back into the output, so a
+    // diamond (two fields naming one error) leaked on its second field. The copy
+    // is registered before its own members are walked, so a cycle terminates on
+    // it and every reference to one error is the same redacted object.
+    const memoized = seen.get(error);
+    if (memoized !== undefined)
+        return memoized;
+    const clone = new Error();
+    seen.set(error, clone);
+    const define = (key, value, enumerable) => {
+        Object.defineProperty(clone, key, { value, writable: true, enumerable, configurable: true });
+    };
+    define("name", redactedText(() => error.name, redactor, "Error"), false);
+    define("message", redactedText(() => error.message, redactor, ""), false);
+    define("stack", redactedStack(error, redactor), false);
+    // Own NAMES, not `Reflect.ownKeys`. A symbol key never crosses: its
+    // description is text no walk can rewrite in place, and the three hooks with
+    // no name to skip are symbols too, `Symbol.toPrimitive`,
+    // `Symbol.toStringTag`, and `nodejs.util.inspect.custom`.
+    for (const key of Object.getOwnPropertyNames(error)) {
+        if (renderHooks.has(key))
+            continue;
+        const descriptor = Object.getOwnPropertyDescriptor(error, key);
+        const value = "value" in descriptor
+            ? descriptor.value
+            : error[key];
+        define(redactedName(key, redactor), 
+        // A credential-named member is replaced wholesale, the way the journal's
+        // own walk replaces one, so both halves of the one rule set answer alike.
+        Redaction.isSensitiveKey(key)
+            ? Redaction.placeholder
+            // The depth cap binds under an Error exactly as it does beside one: a
+            // deep value carried on a cause can exhaust the stack just as easily.
+            : depth + 1 >= renderDepthLimit
+                ? renderDepthMarker
+                : value instanceof Error
+                    ? redactError(value, redactor, seen, depth + 1)
+                    : redactor(value), descriptor.enumerable === true);
+    }
+    return clone;
+};
+/**
+ * Redacts one value on its way out of the logger.
+ *
+ * An `Error` is rebuilt as a plain `Error` whose name, message, stack and own
+ * members are redacted, so a renderer that special-cases an `Error` still gets
+ * one. Everything else goes through the journal's own rules, which rebuild a
+ * value from its plain data: a `Date`, a `Map`, a class instance or a host
+ * object therefore reaches the operator in that plain form rather than as
+ * itself.
+ *
+ * That collapse is deliberate, and it now covers the `Error` too. An earlier
+ * version rebuilt each value on its own prototype to keep the rendering
+ * faithful. Three rounds of review found three ways that could kill the run it
+ * was logging, because a host class keeps state a property walk cannot see and
+ * a copy of one throws the moment a brand check reads it, and four more found
+ * that the prototype an `Error` copy kept was itself the leak: everything it
+ * defines is read by a renderer and seen by no own-key walk. A log line is not
+ * worth a run, and the rendering it buys is cosmetic.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+export const redactArgument = (value, redactor) => {
+    try {
+        return value instanceof Error ? redactError(value, redactor, new WeakMap()) : redactor(value);
+    }
+    catch {
+        // A logged value is arbitrary and a throw here happens while the line is
+        // rendering, which would kill the run the line describes. The marker is
+        // deliberately NOT derived from the value: an earlier fallback rendered
+        // the value to text and printed it, and that text had never been through
+        // the rules, so a credential reached the terminal in clear.
+        return unrenderableMarker;
+    }
+};
+/** What the logger renders in place of a value that cannot be rendered. */
+const unrenderableMarker = "[Unrenderable]";
+/**
+ * A console that runs every value it is handed through `redactor` and then
+ * delegates to `target`.
+ *
+ * @since 0.1.0
+ * @category constructors
+ */
+export const redactingConsole = (target, redactor) => {
+    const methods = target;
+    const view = {};
+    for (const [name, redacts] of Object.entries(consoleMethods)) {
+        const method = methods[name].bind(target);
+        view[name] = redacts
+            ? (...args) => {
+                const redacted = args.map((value) => redactArgument(value, redactor));
+                try {
+                    return method(...redacted);
+                }
+                catch {
+                    // The delegate refused what we handed it. Retry with markers, never
+                    // with a rendering of the values: a rendering has not been through
+                    // the rules, and printing one is how a credential reached the
+                    // terminal before. A delegate that refuses the markers too is out of
+                    // options, and a log line is not worth the run.
+                    try {
+                        return method(...redacted.map(() => unrenderableMarker));
+                    }
+                    catch {
+                        return undefined;
+                    }
+                }
+            }
+            : method;
+    }
+    return view;
+};
+/**
+ * A view of `fiber` whose console redacts and whose log annotations are
+ * already redacted.
+ *
+ * The view inherits from the fiber itself, so `id`, `currentSpan`, and every
+ * other member a logger reads answer exactly as before; only the two
+ * references a logger renders from are substituted.
+ */
+const redactedFiber = (fiber, redactor) => {
+    const view = Object.create(fiber);
+    Object.defineProperty(view, "getRef", {
+        value: (reference) => {
+            const current = fiber.getRef(reference);
+            if (reference === Console.Console) {
+                return redactingConsole(current, redactor);
+            }
+            if (reference === References.CurrentLogAnnotations) {
+                // The same treatment a message part gets, so one log event obeys one
+                // rule and an annotated Error is redacted like a logged one.
+                return redactArgument(current, redactor);
+            }
+            return current;
+        }
+    });
+    return view;
+};
+/**
+ * Rebuilds the frame chain as redacted data. Evaluate the lazy stack here:
+ * carrying its original function would defer the credential past the boundary.
+ * The same depth cap as logged values also bounds cyclic parent chains.
+ */
+const redactedFrame = (frame, redactor, depth = 0) => {
+    if (frame === undefined)
+        return undefined;
+    if (depth >= renderDepthLimit) {
+        return { name: renderDepthMarker, stack: () => undefined, parent: undefined };
+    }
+    const stack = redactedText(() => frame.stack() ?? "", redactor, unrenderableMarker);
+    return {
+        name: redactedText(() => frame.name, redactor, unrenderableMarker),
+        stack: () => stack,
+        parent: redactedFrame(frame.parent, redactor, depth + 1)
+    };
+};
+/**
+ * The log event's cause with the rules applied to failures, defects and stack
+ * annotations. `Cause.pretty` renders these frames after rendering the error;
+ * the tracer exports that text without passing through the redacting console.
+ * Interruptions also carry both their own and the interruptor's frame chains.
+ * Rebuild reasons and annotation maps so the original cause stays untouched.
+ */
+const redactedCause = (cause, redactor) => {
+    if (cause.reasons.length === 0)
+        return cause;
+    return Cause.fromReasons(cause.reasons.map((reason) => {
+        const annotations = new Map(reason.annotations);
+        for (const key of [Cause.StackTrace.key, Cause.InterruptorStackTrace.key]) {
+            if (annotations.has(key)) {
+                annotations.set(key, redactedFrame(annotations.get(key), redactor));
+            }
+        }
+        const copy = reason._tag === "Fail"
+            ? Cause.makeFailReason(redactArgument(reason.error, redactor))
+            : reason._tag === "Die"
+                ? Cause.makeDieReason(redactArgument(reason.defect, redactor))
+                : Cause.makeInterruptReason(reason.fiberId);
+        return copy.annotate(Context.makeUnsafe(annotations));
+    }));
+};
+/**
+ * Returns `logger` with the journal's redaction rules over everything it
+ * renders. A logger this module already wrapped is returned unchanged.
+ *
+ * @since 0.1.0
+ * @category combinators
+ */
+export const wrap = (logger, options) => {
+    if (isRedacted(logger))
+        return logger;
+    // A logger NAMES a too-deep value rather than throwing: a throw is caught one
+    // frame up and costs the operator every argument on the line, not just the
+    // deep one. A log line is a diagnostic, so it takes the diagnostic rules. A
+    // caller passing its own `onTooDeep` or `rules` still wins.
+    const redactor = Redaction.make({ onTooDeep: "name", rules: Redaction.diagnosticRules, ...options });
+    const wrapped = Logger.make((logOptions) => logger.log({
+        ...logOptions,
+        // The message is redacted here, not only behind the fiber's Console,
+        // because a logger is free to read it directly: `Logger.tracerLogger`
+        // ships in Effect's default set and publishes the message as a span
+        // event name, so a Console-only substitution would export a credential
+        // in clear to whatever collector is configured.
+        //
+        // Effect delivers the message as an array of parts, one per argument,
+        // including the single-argument case; a non-array reaches here only from
+        // a caller that builds `LogOptions` by hand, and `toArray` covers it
+        // without a branch no test could reach through the logging API.
+        message: (toArray(logOptions.message).map((part) => redactArgument(part, redactor))),
+        // The cause travels the same way and for the same reason. A failure is
+        // logged as a `Cause`, not as message parts (`Effect.logError(cause)`
+        // moves it out of the arguments), and `Logger.tracerLogger` renders it
+        // itself into the span's `effect.cause` attribute without going near the
+        // console, so an error message carrying a token would leave the process
+        // in clear.
+        cause: redactedCause(logOptions.cause, redactor),
+        fiber: redactedFiber(logOptions.fiber, redactor)
+    }));
+    Object.defineProperty(wrapped, TypeId, { value: true });
+    return wrapped;
+};
+/**
+ * Replaces the active logger set with redacting wrappers of the same loggers.
+ *
+ * It composes over whatever loggers are already installed rather than
+ * choosing one, so an operator keeps the FORMAT they had, meaning their own
+ * logger and its layout, though a value inside a line is rendered from its
+ * redacted plain data rather than as its own class, and a host that
+ * installed its own logger keeps it too.
+ *
+ * @since 0.1.0
+ * @category layers
+ */
+export const layer = (options) => Layer.effect(Logger.CurrentLoggers, Effect.withFiber((fiber) => Effect.sync(() => {
+    const wrapped = new Set();
+    for (const logger of fiber.getRef(Logger.CurrentLoggers))
+        wrapped.add(wrap(logger, options));
+    return wrapped;
+})));
+//# sourceMappingURL=RedactedLogger.js.map

package/dist/esm/RedactedLogger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RedactedLogger.js","sourceRoot":"","sources":["../../src/RedactedLogger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAE3C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,MAAM,GAAkB,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAA+B,EAAW,EAAE,CAAC,MAAM,IAAI,MAAM,CAAA;AAExF;;;;;;;;;;;;GAYG;AACH,MAAM,cAAc,GAAG;IACrB,MAAM,EAAE,IAAI;IACZ,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,IAAI;IACX,UAAU,EAAE,IAAI;IAChB,KAAK,EAAE,IAAI;IACX,GAAG,EAAE,IAAI;IACT,MAAM,EAAE,IAAI;IACZ,KAAK,EAAE,IAAI;IACX,KAAK,EAAE,IAAI;IACX,cAAc,EAAE,IAAI;IACpB,QAAQ,EAAE,KAAK;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,IAAI;IACT,KAAK,EAAE,IAAI;IACX,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,IAAI;IACX,IAAI,EAAE,IAAI;CACF,CAAA;AAEV,oEAAoE;AACpE,MAAM,gBAAgB,GAAG,GAAG,CAAA;AAE5B,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,QAAQ,CAAA;AAElC;;;;;;;;;GASG;AACH,MAAM,OAAO,GAAG,CAAC,OAAgB,EAA0B,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;AAE1G;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG,CAAC,IAAmB,EAAE,QAA4B,EAAE,QAAgB,EAAU,EAAE;IACnG,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAA;IACjB,CAAC;AACH,CAAC,CAAA;AAED,gFAAgF;AAChF,MAAM,aAAa,GAAG,CAAC,KAAY,EAAE,QAA4B,EAAsB,EAAE;IACvF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;QACzB,sEAAsE;QACtE,wEAAwE;QACxE,qDAAqD;QACrD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,QAA4B,EAAU,EAAE;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IACtC,OAAO,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAA;AACvD,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IAC/C,aAAa;IACb,SAAS;IACT,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,SAAS;CACV,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,GAAG,CAClB,KAAY,EACZ,QAA4B,EAC5B,IAA2B,EAC3B,KAAK,GAAG,CAAC,EACF,EAAE;IACT,2EAA2E;IAC3E,uEAAuE;IACvE,6EAA6E;IAC7E,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAA;IAC3C,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAA;IACzB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACtB,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,UAAmB,EAAQ,EAAE;QACxE,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9F,CAAC,CAAA;IACD,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAA;IACxE,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;IACzE,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAA;IACtD,oEAAoE;IACpE,6EAA6E;IAC7E,yDAAyD;IACzD,0DAA0D;IAC1D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAClC,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAE,CAAA;QAC/D,MAAM,KAAK,GAAG,OAAO,IAAI,UAAU;YACjC,CAAC,CAAC,UAAU,CAAC,KAAK;YAClB,CAAC,CAAE,KAAiD,CAAC,GAAG,CAAC,CAAA;QAC3D,MAAM,CACJ,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC;QAC3B,yEAAyE;QACzE,0EAA0E;QAC1E,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC;YAC3B,CAAC,CAAC,SAAS,CAAC,WAAW;YACvB,sEAAsE;YACtE,sEAAsE;YACtE,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,gBAAgB;gBAC/B,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,KAAK,YAAY,KAAK;oBACxB,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;oBAC/C,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EACnB,UAAU,CAAC,UAAU,KAAK,IAAI,CAC/B,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAc,EAAE,QAA4B,EAAW,EAAE;IACtF,IAAI,CAAC;QACH,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,4DAA4D;QAC5D,OAAO,kBAAkB,CAAA;IAC3B,CAAC;AACH,CAAC,CAAA;AAED,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,gBAAgB,CAAA;AAE3C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAuB,EAAE,QAA4B,EAAmB,EAAE;IACzG,MAAM,OAAO,GAAG,MAA6E,CAAA;IAC7F,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO;YAClB,CAAC,CAAC,CAAC,GAAG,IAA4B,EAAE,EAAE;gBACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAA;gBACrE,IAAI,CAAC;oBACH,OAAO,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAA;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,oEAAoE;oBACpE,mEAAmE;oBACnE,8DAA8D;oBAC9D,qEAAqE;oBACrE,gDAAgD;oBAChD,IAAI,CAAC;wBACH,OAAO,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAA;oBAC1D,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,SAAS,CAAA;oBAClB,CAAC;gBACH,CAAC;YACH,CAAC;YACD,CAAC,CAAC,MAAM,CAAA;IACZ,CAAC;IACD,OAAO,IAAkC,CAAA;AAC3C,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,CACpB,KAAoC,EACpC,QAA4B,EACG,EAAE;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAkC,CAAA;IAClE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE;QACpC,KAAK,EAAE,CAAI,SAA+B,EAAK,EAAE;YAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACvC,IAAI,SAAS,KAAM,OAAO,CAAC,OAA2C,EAAE,CAAC;gBACvE,OAAO,gBAAgB,CAAC,OAA0B,EAAE,QAAQ,CAAM,CAAA;YACpE,CAAC;YACD,IAAI,SAAS,KAAM,UAAU,CAAC,qBAAyD,EAAE,CAAC;gBACxF,qEAAqE;gBACrE,6DAA6D;gBAC7D,OAAO,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAM,CAAA;YAC/C,CAAC;YACD,OAAO,OAAO,CAAA;QAChB,CAAC;KACF,CAAC,CAAA;IACF,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,aAAa,GAAG,CACpB,KAAwC,EACxC,QAA4B,EAC5B,KAAK,GAAG,CAAC,EAC0B,EAAE;IACrC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,KAAK,IAAI,gBAAgB,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC/E,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAA;IACnF,OAAO;QACL,IAAI,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC;QAClE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK;QAClB,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC;KACzD,CAAA;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,CACpB,KAA2B,EAC3B,QAA4B,EACN,EAAE;IACxB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5C,OAAO,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACpD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QAC/C,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1E,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAsC,EAAE,QAAQ,CAAC,CAAC,CAAA;YAC1G,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM;YACjC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC9D,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK;gBACvB,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC9D,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;IACvD,CAAC,CAAC,CAAC,CAAA;AACL,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,MAAsC,EACtC,OAA2B,EACK,EAAE;IAClC,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAA;IACrC,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;IACpG,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAkB,CAAC,UAAU,EAAE,EAAE,CAC1D,MAAM,CAAC,GAAG,CAAC;QACT,GAAG,UAAU;QACb,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,gDAAgD;QAChD,EAAE;QACF,sEAAsE;QACtE,yEAAyE;QACzE,qEAAqE;QACrE,gEAAgE;QAChE,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAY;QAC/F,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,YAAY;QACZ,KAAK,EAAE,aAAa,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC;QAChD,KAAK,EAAE,aAAa,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC;KACjD,CAAC,CACH,CAAA;IACD,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACvD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAA2B,EAAsB,EAAE,CACvE,KAAK,CAAC,MAAM,CACV,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CACzB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;IACf,MAAM,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAA;IACtD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC5F,OAAO,OAAO,CAAA;AAChB,CAAC,CAAC,CACH,CACF,CAAA","sourcesContent":["/**\n * The redacting logger: the journal's redaction rules applied to log output.\n *\n * The journal redacts on the write path, so a credential a cell logs or\n * returns never reaches a committed row (`./Redaction.ts`). The operator's\n * terminal was the other place the same credential surfaces: every built-in\n * Effect logger renders through the fiber's `Console`, so an action that hands\n * a token to `Effect.logInfo` wrote it to stderr in full and it reached\n * whatever collected that stream.\n *\n * This module closes that half with the SAME rules rather than a second rule\n * set. {@link wrap} does not re-implement redaction and does not re-format a\n * log line. It redacts the log event itself — the message, the cause, and the\n * log annotations — before the wrapped logger is handed it, and it hands that\n * logger a view of the fiber whose `Console` is a redacting console, so\n * whatever the logger renders for itself — a pretty line, a JSON document —\n * passes through `Redaction.redact` on its way to the stream as well.\n *\n * Both halves carry load. Most built-in loggers write through the fiber's\n * `Console`, which is what covers the pretty line, the `--json` document, and\n * the `.flows/logs/<runId>.log` stream. But a logger is free to read the event\n * instead of rendering it, and one in Effect's own default logger set does:\n * `Logger.tracerLogger` publishes the message as a span event name and\n * `Cause.pretty` of the cause as the span's `effect.cause` attribute, and\n * never reads `Console` at all. Redacting only the console would hide a\n * credential on stderr and export it in clear to whatever OTLP collector is\n * configured.\n *\n * Cost is bounded by the rules themselves: every alternation inside a\n * repetition in `Redaction.diagnosticRules` starts its branches with disjoint\n * characters, so each rule is linear in the length of the line and no input\n * backtracks catastrophically.\n *\n * One deliberate difference from the journal write path. `Redaction.redact`\n * rebuilds an object from its own enumerable entries, which is right for a row\n * that is about to be JSON-encoded and wrong for a terminal: an `Error` keeps\n * `message` and `stack` on non-enumerable properties, so rebuilding one prints\n * `{}` where the operator expected a failure. An `Error` is rebuilt as a plain\n * `Error` instead, carrying its name, message, stack and own members with the\n * rules applied. Its class is NOT preserved. A copy built on the original's\n * prototype inherits everything the prototype defines, an own-key walk sees\n * none of it, and each of `name`, `cause`, `toJSON`, `Symbol.toStringTag` and\n * `nodejs.util.inspect.custom` carried a credential out that way.\n *\n * @since 0.1.0\n */\n\nimport * as Cause from \"effect/Cause\"\nimport * as Console from \"effect/Console\"\nimport * as Context from \"effect/Context\"\nimport * as Effect from \"effect/Effect\"\nimport type * as Fiber from \"effect/Fiber\"\nimport * as Layer from \"effect/Layer\"\nimport * as Logger from \"effect/Logger\"\nimport * as References from \"effect/References\"\nimport * as Redaction from \"./Redaction.ts\"\n\n/**\n * Marks a logger this module already wrapped.\n *\n * Both the CLI and the durable runtime install {@link layer}, and a detached\n * `smithers run` is both at once. Wrapping twice would be correct but pay the\n * rules twice per line, so a wrapped logger is returned unchanged.\n *\n * @since 0.1.0\n * @category type ids\n */\nexport const TypeId: unique symbol = Symbol.for(\"@smthrs/journal/RedactedLogger\")\n\n/**\n * Whether {@link wrap} already wrapped this logger.\n *\n * @since 0.1.0\n * @category predicates\n */\nexport const isRedacted = (logger: Logger.Logger<any, any>): boolean => TypeId in logger\n\n/**\n * Console methods that write caller-supplied values, mapped to whether their\n * arguments carry log output.\n *\n * Only `clear` and `groupEnd` are marked `false`, because those two take no\n * arguments at all: there is nothing for the rules to read and binding them\n * straight through saves a copy per call. Every other method here, `count`,\n * `countReset`, `time`, and `timeEnd` included, accepts a caller-supplied\n * LABEL and prints it, so a label of `api_key=sk-…` reached the terminal\n * through all four of them. `timeLog` already redacted its label, so the pair\n * `time` / `timeLog` also disagreed about what a timer is called; redacting all\n * of them is what makes a label match itself again.\n */\nconst consoleMethods = {\n  assert: true,\n  clear: false,\n  count: true,\n  countReset: true,\n  debug: true,\n  dir: true,\n  dirxml: true,\n  error: true,\n  group: true,\n  groupCollapsed: true,\n  groupEnd: false,\n  info: true,\n  log: true,\n  table: true,\n  time: true,\n  timeEnd: true,\n  timeLog: true,\n  trace: true,\n  warn: true\n} as const\n\n/** How deep the logger walks a value before it names it instead. */\nconst renderDepthLimit = 200\n\n/** What the logger renders in place of a value nested past the depth limit. */\nconst renderDepthMarker = \"[Deep]\"\n\n/**\n * The parts of a log message.\n *\n * Effect's logging API passes an array, one entry per argument, including for\n * a single argument. A caller that builds `LogOptions` by hand may pass the\n * message itself, so it is wrapped rather than walked.\n *\n * @since 0.1.0\n * @category redaction\n */\nconst toArray = (message: unknown): ReadonlyArray<unknown> => Array.isArray(message) ? message : [message]\n\n/**\n * Reads one piece of text off `error` and runs it through the rules.\n *\n * Everything a renderer prints about an error is read here, once, and only the\n * redacted result crosses to the copy. A caller's error can define any of these\n * as an accessor that throws, and reading one happens while a log line is\n * rendering, so a refusal costs that piece of text and nothing else.\n */\nconst redactedText = (read: () => unknown, redactor: Redaction.Redactor, fallback: string): string => {\n  try {\n    return String(redactor(String(read())))\n  } catch {\n    return fallback\n  }\n}\n\n/** `error.stack` through the rules, or `undefined` when it has none to give. */\nconst redactedStack = (error: Error, redactor: Redaction.Redactor): string | undefined => {\n  try {\n    const stack = error.stack\n    // An `Error.stack` is optional. Under `exactOptionalPropertyTypes` an\n    // assignment cannot carry the `undefined` a stackless error has, so the\n    // copy defines the property instead of assigning it.\n    return typeof stack === \"string\" ? String(redactor(stack)) : undefined\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * A member NAME with the rules applied, replaced outright when one fires.\n *\n * The treatment `Redaction.redact` gives an object key, for the same reason: a\n * name is text a renderer prints. Rewriting one in place would change what it\n * reads as and redaction would stop being a fixed point, so a name that matches\n * becomes the placeholder whole.\n */\nconst redactedName = (key: string, redactor: Redaction.Redactor): string => {\n  const redacted = String(redactor(key))\n  return redacted === key ? key : Redaction.placeholder\n}\n\n/**\n * Own names the copy never carries, because a renderer CALLS them.\n *\n * `name`, `message` and `stack` are defined from the rules above instead. The\n * rest are hooks: a redacted `toString` or `valueOf` would leave a string under\n * a name the language calls, and `String(error)` would then throw from inside\n * the renderer, which is the failure mode this module exists to avoid.\n */\nconst renderHooks: ReadonlySet<string> = new Set([\n  \"constructor\",\n  \"message\",\n  \"name\",\n  \"stack\",\n  \"toJSON\",\n  \"toString\",\n  \"valueOf\"\n])\n\n/**\n * A copy of `error` carrying the same information with the rules applied.\n *\n * A PLAIN `Error`, never a copy built on the original's prototype. A prototype\n * is an unbounded leak surface and an own-key walk never looks at one: an\n * inherited `name`, `cause`, `toJSON`, `Symbol.toStringTag` or\n * `nodejs.util.inspect.custom` each carried a credential straight to an OTLP\n * span attribute or to the operator's terminal, one per review round, and a\n * getter anywhere on the chain is the same hole with a different name. So\n * nothing inherited crosses. Only redacted text does: the name, the message,\n * the stack, and the error's own members, each read once here and stored as\n * data, since a getter carried across unchanged would hand the unredacted\n * value to whatever reads it next.\n *\n * The copy is not an instance of the original's class, so a renderer that\n * special-cases `instanceof MyError` sees a plain `Error`. That is the fidelity\n * trade the release policy already records for every other value, and it is\n * the trade the same problem's earlier, crashing form was settled with: a copy\n * on a host prototype, such as the `DOMException` an `AbortSignal` carries as\n * its reason, is an impostor whose brand check throws from inside `Cause.pretty`\n * and kills the run the line was describing.\n */\nconst redactError = (\n  error: Error,\n  redactor: Redaction.Redactor,\n  seen: WeakMap<Error, Error>,\n  depth = 0\n): Error => {\n  // The memo holds the COPY, not a visited mark: returning the original on a\n  // repeat reference put the unredacted error back into the output, so a\n  // diamond (two fields naming one error) leaked on its second field. The copy\n  // is registered before its own members are walked, so a cycle terminates on\n  // it and every reference to one error is the same redacted object.\n  const memoized = seen.get(error)\n  if (memoized !== undefined) return memoized\n  const clone = new Error()\n  seen.set(error, clone)\n  const define = (key: string, value: unknown, enumerable: boolean): void => {\n    Object.defineProperty(clone, key, { value, writable: true, enumerable, configurable: true })\n  }\n  define(\"name\", redactedText(() => error.name, redactor, \"Error\"), false)\n  define(\"message\", redactedText(() => error.message, redactor, \"\"), false)\n  define(\"stack\", redactedStack(error, redactor), false)\n  // Own NAMES, not `Reflect.ownKeys`. A symbol key never crosses: its\n  // description is text no walk can rewrite in place, and the three hooks with\n  // no name to skip are symbols too, `Symbol.toPrimitive`,\n  // `Symbol.toStringTag`, and `nodejs.util.inspect.custom`.\n  for (const key of Object.getOwnPropertyNames(error)) {\n    if (renderHooks.has(key)) continue\n    const descriptor = Object.getOwnPropertyDescriptor(error, key)!\n    const value = \"value\" in descriptor\n      ? descriptor.value\n      : (error as unknown as Record<PropertyKey, unknown>)[key]\n    define(\n      redactedName(key, redactor),\n      // A credential-named member is replaced wholesale, the way the journal's\n      // own walk replaces one, so both halves of the one rule set answer alike.\n      Redaction.isSensitiveKey(key)\n        ? Redaction.placeholder\n        // The depth cap binds under an Error exactly as it does beside one: a\n        // deep value carried on a cause can exhaust the stack just as easily.\n        : depth + 1 >= renderDepthLimit\n        ? renderDepthMarker\n        : value instanceof Error\n        ? redactError(value, redactor, seen, depth + 1)\n        : redactor(value),\n      descriptor.enumerable === true\n    )\n  }\n  return clone\n}\n\n/**\n * Redacts one value on its way out of the logger.\n *\n * An `Error` is rebuilt as a plain `Error` whose name, message, stack and own\n * members are redacted, so a renderer that special-cases an `Error` still gets\n * one. Everything else goes through the journal's own rules, which rebuild a\n * value from its plain data: a `Date`, a `Map`, a class instance or a host\n * object therefore reaches the operator in that plain form rather than as\n * itself.\n *\n * That collapse is deliberate, and it now covers the `Error` too. An earlier\n * version rebuilt each value on its own prototype to keep the rendering\n * faithful. Three rounds of review found three ways that could kill the run it\n * was logging, because a host class keeps state a property walk cannot see and\n * a copy of one throws the moment a brand check reads it, and four more found\n * that the prototype an `Error` copy kept was itself the leak: everything it\n * defines is read by a renderer and seen by no own-key walk. A log line is not\n * worth a run, and the rendering it buys is cosmetic.\n *\n * @since 0.1.0\n * @category redaction\n */\nexport const redactArgument = (value: unknown, redactor: Redaction.Redactor): unknown => {\n  try {\n    return value instanceof Error ? redactError(value, redactor, new WeakMap()) : redactor(value)\n  } catch {\n    // A logged value is arbitrary and a throw here happens while the line is\n    // rendering, which would kill the run the line describes. The marker is\n    // deliberately NOT derived from the value: an earlier fallback rendered\n    // the value to text and printed it, and that text had never been through\n    // the rules, so a credential reached the terminal in clear.\n    return unrenderableMarker\n  }\n}\n\n/** What the logger renders in place of a value that cannot be rendered. */\nconst unrenderableMarker = \"[Unrenderable]\"\n\n/**\n * A console that runs every value it is handed through `redactor` and then\n * delegates to `target`.\n *\n * @since 0.1.0\n * @category constructors\n */\nexport const redactingConsole = (target: Console.Console, redactor: Redaction.Redactor): Console.Console => {\n  const methods = target as unknown as Record<string, (...args: ReadonlyArray<any>) => unknown>\n  const view: Record<string, unknown> = {}\n  for (const [name, redacts] of Object.entries(consoleMethods)) {\n    const method = methods[name]!.bind(target)\n    view[name] = redacts\n      ? (...args: ReadonlyArray<unknown>) => {\n        const redacted = args.map((value) => redactArgument(value, redactor))\n        try {\n          return method(...redacted)\n        } catch {\n          // The delegate refused what we handed it. Retry with markers, never\n          // with a rendering of the values: a rendering has not been through\n          // the rules, and printing one is how a credential reached the\n          // terminal before. A delegate that refuses the markers too is out of\n          // options, and a log line is not worth the run.\n          try {\n            return method(...redacted.map(() => unrenderableMarker))\n          } catch {\n            return undefined\n          }\n        }\n      }\n      : method\n  }\n  return view as unknown as Console.Console\n}\n\n/**\n * A view of `fiber` whose console redacts and whose log annotations are\n * already redacted.\n *\n * The view inherits from the fiber itself, so `id`, `currentSpan`, and every\n * other member a logger reads answer exactly as before; only the two\n * references a logger renders from are substituted.\n */\nconst redactedFiber = (\n  fiber: Fiber.Fiber<unknown, unknown>,\n  redactor: Redaction.Redactor\n): Fiber.Fiber<unknown, unknown> => {\n  const view = Object.create(fiber) as Fiber.Fiber<unknown, unknown>\n  Object.defineProperty(view, \"getRef\", {\n    value: <X>(reference: Context.Reference<X>): X => {\n      const current = fiber.getRef(reference)\n      if (reference === (Console.Console as unknown as Context.Reference<X>)) {\n        return redactingConsole(current as Console.Console, redactor) as X\n      }\n      if (reference === (References.CurrentLogAnnotations as unknown as Context.Reference<X>)) {\n        // The same treatment a message part gets, so one log event obeys one\n        // rule and an annotated Error is redacted like a logged one.\n        return redactArgument(current, redactor) as X\n      }\n      return current\n    }\n  })\n  return view\n}\n\n/**\n * Rebuilds the frame chain as redacted data. Evaluate the lazy stack here:\n * carrying its original function would defer the credential past the boundary.\n * The same depth cap as logged values also bounds cyclic parent chains.\n */\nconst redactedFrame = (\n  frame: References.StackFrame | undefined,\n  redactor: Redaction.Redactor,\n  depth = 0\n): References.StackFrame | undefined => {\n  if (frame === undefined) return undefined\n  if (depth >= renderDepthLimit) {\n    return { name: renderDepthMarker, stack: () => undefined, parent: undefined }\n  }\n  const stack = redactedText(() => frame.stack() ?? \"\", redactor, unrenderableMarker)\n  return {\n    name: redactedText(() => frame.name, redactor, unrenderableMarker),\n    stack: () => stack,\n    parent: redactedFrame(frame.parent, redactor, depth + 1)\n  }\n}\n\n/**\n * The log event's cause with the rules applied to failures, defects and stack\n * annotations. `Cause.pretty` renders these frames after rendering the error;\n * the tracer exports that text without passing through the redacting console.\n * Interruptions also carry both their own and the interruptor's frame chains.\n * Rebuild reasons and annotation maps so the original cause stays untouched.\n */\nconst redactedCause = (\n  cause: Cause.Cause<unknown>,\n  redactor: Redaction.Redactor\n): Cause.Cause<unknown> => {\n  if (cause.reasons.length === 0) return cause\n  return Cause.fromReasons(cause.reasons.map((reason) => {\n    const annotations = new Map(reason.annotations)\n    for (const key of [Cause.StackTrace.key, Cause.InterruptorStackTrace.key]) {\n      if (annotations.has(key)) {\n        annotations.set(key, redactedFrame(annotations.get(key) as References.StackFrame | undefined, redactor))\n      }\n    }\n    const copy = reason._tag === \"Fail\"\n      ? Cause.makeFailReason(redactArgument(reason.error, redactor))\n      : reason._tag === \"Die\"\n      ? Cause.makeDieReason(redactArgument(reason.defect, redactor))\n      : Cause.makeInterruptReason(reason.fiberId)\n    return copy.annotate(Context.makeUnsafe(annotations))\n  }))\n}\n\n/**\n * Returns `logger` with the journal's redaction rules over everything it\n * renders. A logger this module already wrapped is returned unchanged.\n *\n * @since 0.1.0\n * @category combinators\n */\nexport const wrap = <Message, Output>(\n  logger: Logger.Logger<Message, Output>,\n  options?: Redaction.Options\n): Logger.Logger<Message, Output> => {\n  if (isRedacted(logger)) return logger\n  // A logger NAMES a too-deep value rather than throwing: a throw is caught one\n  // frame up and costs the operator every argument on the line, not just the\n  // deep one. A log line is a diagnostic, so it takes the diagnostic rules. A\n  // caller passing its own `onTooDeep` or `rules` still wins.\n  const redactor = Redaction.make({ onTooDeep: \"name\", rules: Redaction.diagnosticRules, ...options })\n  const wrapped = Logger.make<Message, Output>((logOptions) =>\n    logger.log({\n      ...logOptions,\n      // The message is redacted here, not only behind the fiber's Console,\n      // because a logger is free to read it directly: `Logger.tracerLogger`\n      // ships in Effect's default set and publishes the message as a span\n      // event name, so a Console-only substitution would export a credential\n      // in clear to whatever collector is configured.\n      //\n      // Effect delivers the message as an array of parts, one per argument,\n      // including the single-argument case; a non-array reaches here only from\n      // a caller that builds `LogOptions` by hand, and `toArray` covers it\n      // without a branch no test could reach through the logging API.\n      message: (toArray(logOptions.message).map((part) => redactArgument(part, redactor))) as Message,\n      // The cause travels the same way and for the same reason. A failure is\n      // logged as a `Cause`, not as message parts (`Effect.logError(cause)`\n      // moves it out of the arguments), and `Logger.tracerLogger` renders it\n      // itself into the span's `effect.cause` attribute without going near the\n      // console, so an error message carrying a token would leave the process\n      // in clear.\n      cause: redactedCause(logOptions.cause, redactor),\n      fiber: redactedFiber(logOptions.fiber, redactor)\n    })\n  )\n  Object.defineProperty(wrapped, TypeId, { value: true })\n  return wrapped\n}\n\n/**\n * Replaces the active logger set with redacting wrappers of the same loggers.\n *\n * It composes over whatever loggers are already installed rather than\n * choosing one, so an operator keeps the FORMAT they had, meaning their own\n * logger and its layout, though a value inside a line is rendered from its\n * redacted plain data rather than as its own class, and a host that\n * installed its own logger keeps it too.\n *\n * @since 0.1.0\n * @category layers\n */\nexport const layer = (options?: Redaction.Options): Layer.Layer<never> =>\n  Layer.effect(\n    Logger.CurrentLoggers,\n    Effect.withFiber((fiber) =>\n      Effect.sync(() => {\n        const wrapped = new Set<Logger.Logger<unknown, any>>()\n        for (const logger of fiber.getRef(Logger.CurrentLoggers)) wrapped.add(wrap(logger, options))\n        return wrapped\n      })\n    )\n  )\n"]}