@smthrs/journal 0.0.0-stage → 1.0.0-rc.3

package/dist/esm/Redaction.js

@@ -0,0 +1,1584 @@
+/**
+ * Payload redaction for durable journal writes.
+ *
+ * The journal is permanent and broadly readable: every entry is replayed to
+ * sync subscribers and to time-travel consumers. A secret that reaches
+ * `payload_json` is therefore not a transient leak, so redaction happens once,
+ * on the journal write path, rather than at each reader.
+ *
+ * Redaction is an **observability** concern and is confined to journal events
+ * and export/display surfaces. It is deliberately not applied to executable
+ * state, `flows_runs.state_json`, attempt checkpoints, errors, outcomes, and
+ * cache results, because those are decoded and re-entered on resume: a
+ * placeholder there resumes the flow with the wrong data, and replacing a
+ * non-string value with a placeholder string makes the persisted state fail
+ * schema decode outright, leaving the run undrivable (issue #72). A value
+ * that must never reach durable executable state is a `Redacted` field in the
+ * caller's own schema, not a name-suffix guess made at the storage seam.
+ *
+ * The rule set is a best-effort textual net over credential shapes seen in
+ * real bug reports, plus structural redaction by sensitive field name. It is
+ * finite, so a value that must never persist belongs in a `Redacted` field of
+ * the caller's own schema. See https://journal.smithers.sh/concepts/redaction/
+ * for the rule set and how to replace it.
+ *
+ * @since 0.1.0
+ */
+import * as Result from "effect/Result";
+import * as Schema from "effect/Schema";
+/** JSON text carrying an arbitrary decoded value. */
+const UnknownFromJsonString = Schema.fromJsonString(Schema.Unknown);
+/**
+ * The placeholder written in place of a redacted value.
+ *
+ * @since 0.1.0
+ * @category constants
+ */
+export const placeholder = "[REDACTED]";
+const isQuote = (char) => char === "\"" || char === "'" || char === "`";
+const closers = { "{": "}", "[": "]", "(": ")" };
+/**
+ * Whether the last {@link skipQuoted} or {@link skipContainer} found its
+ * closer. Both return the end of the text for a value that never closes, and
+ * for one that closes on the text's last character, so the end alone cannot
+ * say which.
+ */
+let lastClosed = false;
+/**
+ * The index just past the quote that closes the string opened at `open`. A
+ * quote nested n strings deep sits behind `depth` = 2^n - 1 backslashes, and
+ * the quote that closes it has that count modulo 2^(n+1). A string that is
+ * never closed, cut by a bound or by its producer, runs to the end of the
+ * text. A caller that knows the backslashes were doubled again passes a larger
+ * `modulus`.
+ */
+const skipQuoted = (text, open, depth, modulus = 2 * (depth + 1), limit = text.length) => {
+    let end = open + 1;
+    while (end < limit) {
+        if (text[end] === text[open]) {
+            let slashes = 0;
+            for (let i = end - 1; i > open && text[i] === "\\"; i--)
+                slashes++;
+            if (slashes % modulus === depth) {
+                lastClosed = true;
+                return end + 1;
+            }
+        }
+        end++;
+    }
+    lastClosed = false;
+    return end;
+};
+/**
+ * The index just past the bracket that balances the one at `open`, skipping
+ * quoted strings at any escape depth. An unbalanced container runs to the end
+ * of the text.
+ */
+const skipContainer = (text, open, limit = text.length) => {
+    const pending = [];
+    let end = open;
+    while (end < limit) {
+        const char = text[end];
+        if (isQuote(char)) {
+            let depth = 0;
+            while (text[end - 1 - depth] === "\\")
+                depth++;
+            end = skipQuoted(text, end, depth, 2 * (depth + 1), limit);
+            if (!lastClosed)
+                return end;
+            continue;
+        }
+        const closer = closers[char];
+        if (closer !== undefined)
+            pending.push(closer);
+        else if (char === pending.at(-1)) {
+            pending.pop();
+            if (pending.length === 0) {
+                lastClosed = true;
+                return end + 1;
+            }
+        }
+        end++;
+    }
+    lastClosed = false;
+    return end;
+};
+/**
+ * The escape depth of a quote behind `slashes` backslashes: 2^k - 1 for its k
+ * trailing escaped levels, so `\\"` (an escaped backslash, then a quote) is
+ * depth 0 and `\\\"` is depth 1.
+ */
+const escapeDepth = (slashes) => (slashes ^ (slashes + 1)) >> 1;
+const innermostString = (stack) => stack.at(-1)?.string ?? -1;
+/**
+ * Updates `stack` with the brackets and strings that `text[from, to)` opens
+ * and closes. A quote closes the innermost open string it can close at that
+ * string's escape depth, and otherwise opens a string at its own depth. The
+ * other quote characters inside a string are content (`"don't"`).
+ */
+const track = (stack, text, from, to) => {
+    for (let i = from; i < to; i++) {
+        const char = text[i];
+        if (isQuote(char)) {
+            let slashes = 0;
+            while (text[i - 1 - slashes] === "\\")
+                slashes++;
+            const inner = innermostString(stack);
+            if (inner === -1) {
+                stack.push({ close: char, depth: escapeDepth(slashes), string: stack.length });
+                continue;
+            }
+            if (stack[inner].close !== char)
+                continue;
+            // Only strings can close, so walk the strings alone, innermost first.
+            let closes = inner;
+            while (closes !== -1) {
+                const depth = stack[closes].depth;
+                if (slashes % (2 * (depth + 1)) === depth)
+                    break;
+                closes = closes === 0 ? -1 : stack[closes - 1].string;
+            }
+            if (closes === -1)
+                stack.push({ close: char, depth: escapeDepth(slashes), string: stack.length });
+            else
+                stack.length = closes;
+            continue;
+        }
+        const closer = closers[char];
+        if (closer !== undefined)
+            stack.push({ close: closer, string: innermostString(stack) });
+        else if (stack.at(-1)?.depth === undefined && char === stack.at(-1)?.close)
+            stack.pop();
+    }
+};
+/**
+ * Whether the closer at `end` closes the bracket open before the name: it and
+ * any closers right after it balance the enclosing brackets, and a separator
+ * or the end of the text follows (`[{token:abc}]`, not `Tr0ub4dor)]&3`).
+ */
+const closesEnclosing = (text, end, stack) => {
+    let at = end;
+    for (let k = stack.length - 1; k >= 0 && stack[k].depth === undefined && text[at] === stack[k].close; k--)
+        at++;
+    return at > end && /^(?:[\s,;"'`]|\\+["'`]|$)/.test(text.slice(at, at + 2));
+};
+/** Credential words a name ends in. */
+const credentialWord = "(?:KEY|TOKEN|SECRET|PASSWORD|PASSPHRASE|CREDENTIAL)S?";
+/**
+ * A name's separator: `=`, `:` or `=>`, after any quote that closes the name.
+ * In a durable row it stays on the name's line; a diagnostic also reads a
+ * value on the next line (`password:` then the value), which is how a stream
+ * redactor sees it arrive.
+ */
+const separator = (space) => String.raw `(?:\\*["'\x60])?${space}(?:=>|[=:])${space}`;
+/**
+ * A credential name and its separator. Start once per identifier, including
+ * leading underscores, so a name containing many underscores cannot force
+ * repeated scans of its suffix. The name may close a quote of its own
+ * (`'password':`, `\"token\":`), so a key in a Python repr, an inspected
+ * `Map` or escaped JSON meets the rule too.
+ */
+const credentialName = String.raw `(?<![A-Za-z0-9_-])([A-Za-z0-9_-]*${credentialWord})`;
+const credentialNames = new RegExp(credentialName + separator("[ \\t]*"), "gi");
+const diagnosticNames = new RegExp(credentialName + separator(String.raw `\s*`), "gi");
+/** Case-insensitive authorization names, without making scheme words prose matches. */
+const authorizationName = "(?:proxy-)?authorization".replace(/[a-z]/g, (char) => `[${char}${char.toUpperCase()}]`);
+/** Complete header names whose whole value is a credential whatever its scheme. */
+const headerWord = String.raw `${authorizationName}|${"(?:set-)?cookies?".replace(/[a-z]/g, (char) => `[${char}${char.toUpperCase()}]`)}`;
+// Apostrophes and backticks open quoted names only outside a header token.
+const headerName = String
+    .raw `(?<![A-Za-z0-9!#$%&*+.^_|~-])(?<![A-Za-z0-9!#$%&'*+.^_\x60|~-]['\x60])(${headerWord})`;
+const headerNames = new RegExp(String.raw `((?:proxy-)?authorization|(?:set-)?cookies?)${separator(String.raw `\s*`)}`, "gi");
+/** Whitespace headers require a scheme spelling, so ordinary authorization prose survives. */
+const diagnosticHeaderNames = new RegExp(
+// A trailing token quote requires an opener; double quotes are never token characters.
+`${headerName}(?:` +
+    String.raw `(?:(?<=["'\x60](?:${headerWord}))|(?!\\*['\x60]))${separator(String.raw `\s*`)}|` +
+    String.raw `(?<=${authorizationName})\s+(?=(?:Token|TOKEN|[Bb]earer|BEARER|Basic|BASIC)[ \t]+\S))`, "g");
+/** Any credential or header name, to stop a bare value before the next pair. */
+const anyName = new RegExp(`${credentialNames.source}|${headerNames.source}`, "gi");
+/** A credential or header name and its separator ending the text before a quote. */
+const nameBefore = new RegExp(`(?:${credentialNames.source}|${headerNames.source})$`, "i");
+/**
+ * The index of the next credential or header name at or after `from`; with
+ * `quoted`, only a name written right after a quote.
+ */
+const nextName = (text, from, quoted) => {
+    // No name starts between a search's start and what it found, so a later
+    // search from inside that span has the same answer. Values are read left to
+    // right, so this keeps every search over one text linear in total.
+    const cached = nameSearches[quoted ? 1 : 0];
+    if (cached.text === text && from >= cached.from && from <= cached.found)
+        return cached.found;
+    let found = text.length;
+    anyName.lastIndex = from;
+    for (let match = anyName.exec(text); match !== null; match = anyName.exec(text)) {
+        if (!quoted || isQuote(text[match.index - 1])) {
+            found = match.index;
+            break;
+        }
+    }
+    nameSearches[quoted ? 1 : 0] = { text, from, found };
+    return found;
+};
+/** The last search for any name and for a quoted name. */
+const nameSearches = [{ text: "", from: 0, found: 0 }, { text: "", from: 0, found: 0 }];
+/** The end of the line `index` is on. */
+const lineEnd = (text, index) => {
+    // Every index up to a line's end shares that end, so the last answer serves
+    // each later value on the same line.
+    if (lastLine.text === text && index >= lastLine.from && index <= lastLine.end)
+        return lastLine.end;
+    newline.lastIndex = index;
+    const end = newline.exec(text)?.index ?? text.length;
+    lastLine = { text, from: index, end };
+    return end;
+};
+const newline = /[\r\n]/g;
+let lastLine = { text: "", from: 0, end: 0 };
+/**
+ * Whether the whitespace at `end` continues the one-token value that began at
+ * `start`: `util.inspect` separates a constructor or a marker from its
+ * contents (`Foo {`, `Map(1) {`, `[Object: null prototype] {`, `<ref *1> {`,
+ * `new Password(`).
+ */
+const continuesAcrossSpace = (text, start, end) => {
+    const run = text.slice(start, end);
+    let next = end;
+    while (text[next] === " " || text[next] === "\t")
+        next++;
+    if (run === "new")
+        return next;
+    const prefix = /^[\w$.]+$/.test(run) || /[)\]>]$/.test(run);
+    return prefix && closers[text[next] ?? ""] !== undefined ? next : undefined;
+};
+/**
+ * Whether the `,`, `;` or `&` at `end` separates pairs rather than sitting
+ * inside a value (`Zq7;Syn,thetic`, `Tr0ub(4dor)&3`): a space or another name
+ * follows it, and for `&`, a query parameter (`&page=2`).
+ */
+const separatesPairs = (text, end) => text[end] === "&"
+    ? /^&[A-Za-z_][\w.-]*=/.test(text.slice(end, end + 64))
+    : /^[,;](?:\s|$|\s*\\*["'`]?[A-Za-z_][\w.-]*\\*["'`]?\s*(?:=>|[=:]))/.test(text.slice(end, end + 64));
+/**
+ * How far past its line every durable container may read, whatever the
+ * {@link Budget} has left: a pretty-printed credential object of this size
+ * is read whole on any row.
+ */
+const containerWindow = 4096;
+const containerBudget = 4;
+/**
+ * The end of the bare value at `start`, read as a run of tokens: words,
+ * balanced containers anywhere in it (`{bcrypt}$2a$...`, `Tr0ub(4dor)&3`,
+ * `Some("x")`), inspect markers (`<Buffer 73 65>`, `<ref *1>`), and quoted
+ * parts. `stack` is what is open before the name: the value stops at a quote
+ * that closes the enclosing string, at a closer that closes the enclosing
+ * bracket, and before the next credential name.
+ */
+const bareValueEnd = (text, start, scope, stack, budget) => {
+    const inner = stack[innermostString(stack)];
+    // A durable value never reads an unclosed quote past its line, and one it
+    // cannot close stops at its line. A bracket reads past 4 KiB only while
+    // the text's scan budget lasts: each unbalanced bracket costs a bounded
+    // scan, and all of them together a bounded multiple of the text.
+    const bound = scope.diagnostic ? text.length : lineEnd(text, start);
+    const window = scope.diagnostic
+        ? text.length
+        : Math.min(text.length, start + Math.max(containerWindow, budget.remaining));
+    // Never before the opener: a closed container may already have carried the
+    // value past its first line.
+    const unclosed = (open, end) => Math.max(open, Math.min(end, bound));
+    // A durable container first reads its own line. A pretty-printer only
+    // continues one on the next line after the opener or a member's comma
+    // (`apiKey: {`, `credentials: { a: 1,`), so only then does the scan read on
+    // through the window.
+    const container = (open) => {
+        if (scope.diagnostic)
+            return skipContainer(text, open, window);
+        const end = skipContainer(text, open, bound);
+        if (lastClosed || !/[[{(,]\s*$/.test(text.slice(open, bound)))
+            return end;
+        const past = skipContainer(text, open, window);
+        budget.remaining -= past - open;
+        return past;
+    };
+    let end = start;
+    // The value's own first token is never the next name: in
+    // `api_key=lowercase-secret:end` the value only looks like a `name:` pair.
+    let limit = nextName(text, start + 1, scope.header);
+    // A header value that is one container ends with it: `"cookie":["sid=a"],`.
+    if (scope.header && closers[text[start]] !== undefined) {
+        end = container(start);
+        if (!/^[^\s,;"'`\\)\]}]/.test(text[end] ?? " "))
+            return lastClosed ? end : unclosed(start, end);
+    }
+    while (end < text.length) {
+        if (end >= limit) {
+            if (end === limit)
+                break;
+            limit = nextName(text, end, scope.header);
+            continue;
+        }
+        const char = text[end];
+        if (closers[char] !== undefined) {
+            const open = end;
+            end = container(open);
+            // An unbalanced container runs on, spaces included.
+            if (!lastClosed)
+                return unclosed(open, end);
+            continue;
+        }
+        if (char === "<") {
+            angleClose.lastIndex = end;
+            const close = angleClose.exec(text)?.index;
+            if (close !== undefined && text[close] === ">") {
+                end = close + 1;
+                continue;
+            }
+        }
+        let depth = 0;
+        while (text[end + depth] === "\\")
+            depth++;
+        const quote = text[end + depth];
+        if (isQuote(quote)) {
+            // A quote at the enclosing string's depth or shallower closes it,
+            // whatever precedes it (`Basic abc=`), unless a credential name and
+            // separator precede it (`credential:"`). Inside a bracket, a field's
+            // value ends at a quote (`{\"token\":abc\"}`). Any other quote opens a
+            // quoted part of the value (`username="admin"`, `it's`).
+            const closesString = inner !== undefined && quote === inner.close &&
+                depth % (2 * (inner.depth + 1)) <= inner.depth &&
+                !nameBefore.test(text.slice(Math.max(start, end - 256), end));
+            if (closesString || (!scope.header && inner === undefined && stack.length > 0))
+                break;
+            // A quote between two word characters is an apostrophe (`it's`).
+            if (depth === 0 && /\w/.test(text[end - 1] ?? "") && /\w/.test(text[end + 1] ?? "")) {
+                end++;
+                continue;
+            }
+            const open = end;
+            end = skipQuoted(text, end + depth, depth, 2 * (depth + 1), bound);
+            if (!lastClosed)
+                return unclosed(open, end);
+            continue;
+        }
+        if (char === "\r" || char === "\n")
+            break;
+        // Inside a bracket a `,` or `;` separates members; in raw text it does
+        // when a space or another name follows.
+        if (!scope.header &&
+            ((char === "&" && separatesPairs(text, end)) ||
+                ((char === "," || char === ";") && (stack.length > 0 || separatesPairs(text, end)))))
+            break;
+        if (!scope.header && !scope.diagnostic && (char === " " || char === "\t")) {
+            const next = continuesAcrossSpace(text, start, end);
+            if (next === undefined)
+                break;
+            end = next;
+            continue;
+        }
+        if (closesEnclosing(text, end, stack))
+            break;
+        end++;
+    }
+    while (end > start && /\s/.test(text[end - 1]))
+        end--;
+    return end;
+};
+/**
+ * Whether a name ending in `key` or `keys` is not a credential's: it counts
+ * only where {@link isSensitiveKey} agrees, as it does for the same name as an
+ * object key (`apiKeys` counts; `keys`, `sortKeys`, `idempotencyKey` and
+ * `monkey` do not).
+ */
+const plainKeyName = (name) => /keys?$/i.test(name) && !isSensitiveKey(name);
+/**
+ * The end of a credential that is a URL's password (`//x-access-token:secret@`):
+ * the `@` that closes the userinfo, so the host and path stay readable. Any
+ * other bare value keeps its end.
+ */
+const userinfoEnd = (text, start, end) => {
+    if (!/\/\/[^\s/@?#]*[:=]$/.test(text.slice(Math.max(0, start - 128), start)))
+        return end;
+    const value = text.slice(start, end);
+    const authority = value.search(/[/?#]/);
+    const at = value.lastIndexOf("@", authority < 0 ? value.length : authority);
+    return at > 0 ? start + at : end;
+};
+/**
+ * Whether a name that matched a credential word names a credential: not a
+ * {@link plainKeyName}, and not a count under a plural `tokens` name
+ * (`max_tokens: 4096`), which is accounting.
+ */
+const namesCredential = (name, value) => !plainKeyName(name) &&
+    !(/tokens$/i.test(name) && /^["'`]?\d+(?![\w.])/.test(value));
+/** The `>` that closes an inspect marker, or the line end that means there is none. */
+const angleClose = /[>\r\n]/g;
+/**
+ * The `+` with which `util.inspect` continues a long string on the next line,
+ * its newline raw or escaped (`\\n`) when the inspected text was itself
+ * written into a string.
+ */
+const continuation = /(?:\s|\\+[nrt])*\+(?:\s|\\+[nrt])*/y;
+/** A value an earlier pass already replaced. */
+const alreadyRedacted = /^\[REDACTED\]$/;
+/**
+ * Redacts the value after each name `names` matches. A quoted value is
+ * consumed whole at any string-escape depth, with the pieces `util.inspect`
+ * joins with `+` across lines, and its quotes are kept around the
+ * placeholder; a bare value is consumed as a run of tokens. A name that ends
+ * in `key` counts only where {@link isSensitiveKey} agrees, so `sortKey` and
+ * `idempotencyKey` keep their values, and a count under a plural `tokens`
+ * name, `max_tokens: 4096`, is accounting and is kept too.
+ */
+const redactValues = (text, names, scope) => {
+    const keys = new RegExp(names.source, names.flags);
+    let output = "";
+    let position = 0;
+    // What is open before the current value. Values are skipped, so a bracket
+    // or quote inside a credential never counts.
+    const stack = [];
+    const budget = { remaining: containerBudget * text.length };
+    let scanned = 0;
+    for (let match = keys.exec(text); match !== null; match = keys.exec(text)) {
+        const name = match[1];
+        if (!scope.header && plainKeyName(name))
+            continue;
+        track(stack, text, scanned, keys.lastIndex);
+        scanned = keys.lastIndex;
+        let start = keys.lastIndex;
+        let depth = 0;
+        while (text[start + depth] === "\\")
+            depth++;
+        const opener = text[start + depth];
+        const quote = isQuote(opener) ? opener : undefined;
+        let end;
+        if (quote !== undefined) {
+            start += depth;
+            const inner = stack[innermostString(stack)];
+            if (inner !== undefined) {
+                // Inside a string written with another quote character, every
+                // backslash is doubled again: `inspect` renders `"a\"b"` as
+                // `'"a\\"b"'`.
+                end = skipQuoted(text, start, depth, (inner.close === quote ? 1 : 2 * (inner.depth + 1)) * 2 * (depth + 1));
+            }
+            else {
+                // No enclosing string is visible: raw text, or a string `track` cannot
+                // see. Close no earlier than a doubled string would, but never past the
+                // next credential name: at the undoubled close when only separators
+                // precede that name (`"abc\\", password=`), else at the name.
+                const undoubled = skipQuoted(text, start, depth);
+                end = skipQuoted(text, start, depth, Math.max(4, 2 * (depth + 1)));
+                const next = nextName(text, undoubled, false);
+                if (next < end)
+                    end = /^[\s,;&]*$/.test(text.slice(undoubled, next)) ? undoubled : next;
+            }
+            const closed = end - start > 1 && text[end - 1] === quote;
+            if (!closed && !scope.diagnostic)
+                end = Math.min(end, lineEnd(text, start));
+            // `util.inspect` continues a long string on the next line with `+`.
+            if (depth === 0) {
+                for (continuation.lastIndex = end; continuation.test(text); continuation.lastIndex = end) {
+                    const piece = continuation.lastIndex;
+                    if (!isQuote(text[piece]))
+                        break;
+                    end = skipQuoted(text, piece, 0);
+                }
+            }
+            if (alreadyRedacted.test(text.slice(start + 1, end - (text[end - 1] === quote ? 1 + depth : 0))))
+                continue;
+        }
+        else {
+            end = bareValueEnd(text, start, scope, stack, budget);
+            end = userinfoEnd(text, start, end);
+            // In a journal row a placeholder then a space is a value an earlier pass
+            // already bounded: what follows it is the next part of the line,
+            // `{"statusCode":401}`. A diagnostic value runs over several words, so
+            // there the words after a placeholder are still the value.
+            const bounded = !scope.diagnostic && text.startsWith(placeholder, start) &&
+                /\s/.test(text[start + placeholder.length] ?? "");
+            const kept = end === start || bounded || alreadyRedacted.test(text.slice(start, end)) ||
+                (/tokens$/i.test(name) && /^\d+(?![\w.])/.test(text.slice(start, end))) ||
+                // A Bearer or Basic value the default rules already replaced keeps its scheme.
+                (scope.header && /^(?:bearer|basic)\s+\[REDACTED/i.test(text.slice(start, start + 24)));
+            if (kept)
+                continue;
+        }
+        const escape = quote === undefined ? "" : "\\".repeat(depth);
+        const closed = quote !== undefined && end - start > 1 && text[end - 1] === quote;
+        output += text.slice(position, keys.lastIndex) + escape + (quote ?? "") + placeholder +
+            (closed ? escape + quote : "");
+        position = end;
+        scanned = end;
+        keys.lastIndex = end;
+    }
+    return output + text.slice(position);
+};
+/**
+ * What separates a flag from its value: whitespace on a command line, or
+ * `", "` between two elements of a JSON or inspected array.
+ */
+const argumentSeparator = String.raw `(?:\s+|["'\x60]\s*,\s*["'\x60])`;
+/** A credential flag and the separator before its value. */
+const credentialFlag = new RegExp(String.raw `(?<![A-Za-z0-9_-])(--?[A-Za-z0-9_-]*${credentialWord})${argumentSeparator}`, "gi");
+/** `-p` and the separator before its value, unless the value is a path or a long option. */
+const shortPasswordFlag = new RegExp(String.raw `(?<![^\s"'\x60,[(])-p${argumentSeparator}(?!(?:\.{0,2}|~)\/|--)`, "g");
+/**
+ * A flag that always takes a password, and the separator before it: `plink
+ * -pw`, openssl's `-pass`, `-passin` and `-passout` (`pass:secret`), `-passwd`.
+ */
+const passwordFlag = new RegExp(String.raw `(?<![^\s"'\x60,[(])-p(?:w|ass(?:in|out|wd)?)${argumentSeparator}`, "g");
+/** `-p` with a value attached, unless the word is a known single-dash option. */
+const attachedPasswordFlag = new RegExp(String
+    .raw `(?<![^\s"'\x60,[(])-p(?!(?:rint\w*|rune|erm|ath|threads?|edantic[\w-]*|ipe|ie|g|retty|lain|rogress|rofile|arents|reserve|ass(?:in|out|wd)?|w)(?![^\s"'\x60,\]]))(?=[^\s,\]])`, "g");
+/** `-u` or `--user` and the separator before its value, or `-u` with its value attached (`-uadmin:pw`). */
+const userFlag = new RegExp(String.raw `(?<![^\s"'\x60,[(])(?:(?:-u|--user)(?:=|${argumentSeparator})|-u(?=[^\s=-]))`, "g");
+/**
+ * A flag that takes a password only under one command, and the separator
+ * before its value: `zip -P` (a port to `ssh` and `mysql`) and `redis-cli -a`
+ * or `--pass`. The command is looked for at most 256 characters back on the
+ * same command line.
+ */
+const commandPasswordFlag = new RegExp(String
+    .raw `\b(?:(?:(?:un)?zip|zipcloak)\b[^\r\n|;&]{0,256}?[\s"'\x60,[(]-P|redis-cli\b[^\r\n|;&]{0,256}?[\s"'\x60,[(](?:-a|--pass))${argumentSeparator}`, "g");
+/**
+ * An HTTP header written as a name and value pair of an array
+ * (`[['Authorization', 'Token x']]`), the shape `Headers` entries and many
+ * clients log, up to the quote that opens the value.
+ */
+const headerPair = /(?<![A-Za-z0-9_-])(?:(?:proxy-)?authorization|(?:set-)?cookies?)\\*["'`]\s*,\s*(?=\\*["'`])/gi;
+/** Redacts the quoted value of each {@link headerPair}, keeping its quotes. */
+const redactHeaderPairs = (text) => {
+    const pattern = new RegExp(headerPair.source, headerPair.flags);
+    let output = "";
+    let position = 0;
+    for (let match = pattern.exec(text); match !== null; match = pattern.exec(text)) {
+        let depth = 0;
+        while (text[pattern.lastIndex + depth] === "\\")
+            depth++;
+        const open = pattern.lastIndex + depth;
+        const end = skipQuoted(text, open, depth);
+        const close = lastClosed ? end - 1 - depth : end;
+        if (alreadyRedacted.test(text.slice(open + 1, close)))
+            continue;
+        output += text.slice(position, open + 1) + placeholder;
+        position = close;
+        pattern.lastIndex = end;
+    }
+    return output + text.slice(position);
+};
+/** The placeholder alone, bare, quoted or escaped: a second pass leaves it alone. */
+const redactedArgument = /^(?:\\*(["'`]))?\[REDACTED\](?:\\*\1)?$/;
+/**
+ * The end of the unquoted argument at `start`. It runs to whitespace or a
+ * quote, and on through a quoted part written against it (`abc'def'`, which a
+ * shell reads as one argument) when that part closes before any whitespace
+ * and holds none of `,:{}[]`. Any other quote ends it: the close of a string
+ * the command line sits in (`{"cmd":"mysql -p abc","next":1}`).
+ */
+const wordEnd = (text, start) => {
+    let end = start;
+    while (end < text.length && !/\s/.test(text[end])) {
+        const quote = text[end];
+        if (!isQuote(quote)) {
+            end++;
+            continue;
+        }
+        let close = end + 1;
+        while (close < text.length && !/[\s"'`,:{}[\]]/.test(text[close]))
+            close++;
+        if (close === end + 1 || text[close] !== quote)
+            break;
+        end = close + 1;
+    }
+    return end;
+};
+/**
+ * Redacts the value after each flag `flags` matches: a quoted value, or one
+ * argv word, which ends at whitespace or a quote, so the same rule reads a
+ * command line joined by spaces, a JSON array and an inspected array. A comma
+ * or a `]` is part of a password on a command line (`-p abc,def`); in an
+ * array the element's closing quote ends it first.
+ */
+const redactArguments = (text, flags, 
+/** Whether this flag and value are a credential at all. */
+accept) => {
+    const pattern = new RegExp(flags.source, flags.flags);
+    let output = "";
+    let position = 0;
+    for (let match = pattern.exec(text); match !== null; match = pattern.exec(text)) {
+        const start = pattern.lastIndex;
+        let depth = 0;
+        while (text[start + depth] === "\\")
+            depth++;
+        let end = start;
+        if (isQuote(text[start + depth]))
+            end = skipQuoted(text, start + depth, depth);
+        else
+            end = wordEnd(text, start);
+        const value = text.slice(start, end);
+        if (end === start || redactedArgument.test(value) || accept?.(match, value) === false)
+            continue;
+        output += text.slice(position, start) + placeholder;
+        position = end;
+        pattern.lastIndex = end;
+    }
+    return output + text.slice(position);
+};
+const durable = { header: false, diagnostic: false };
+/**
+ * Best-effort textual rules for credential shapes observed in real reports.
+ * Every replacement reaches a fixed point so replaying or exporting an entry
+ * cannot mutate it again.
+ *
+ * @since 0.1.0
+ * @category constants
+ */
+export const defaultRules = [
+    {
+        id: "private-key-block",
+        // Stop an unterminated block at the next header so repeated headers cannot
+        // each rescan the remaining input. A valid PEM body contains no headers.
+        // A block with no footer is a key a bound or a producer truncated, and its
+        // body is as secret as a whole one's, so it runs to the next header or to
+        // the end of the text. It runs first: a block inside URL userinfo, once
+        // replaced, is userinfo the URL rule then reads whole, so a second pass
+        // finds nothing left to change.
+        pattern: /-----BEGIN[^-]*PRIVATE KEY(?: BLOCK)?-----(?:(?!-----BEGIN)[\s\S])*?(?:-----END[^-]*-----|(?=-----BEGIN)|$)/g
+    },
+    // Git HTTPS OAuth credentials place the secret in the username. Match
+    // before password rewriting removes the x-oauth-basic marker.
+    {
+        id: "git-oauth-userinfo",
+        pattern: /(https?:\/\/)[^\s/@:"'\\]+:x-oauth-basic@/gi,
+        replace: "$1[REDACTED]@"
+    },
+    {
+        id: "url-credentials",
+        // The scheme is bounded rather than open. `-` is not a word character, so
+        // `\b[a-z][a-z0-9+.-]*` starts a fresh scan after every hyphen, and on a
+        // long run of that shape the rule rescanned the tail from each one: 400 kB
+        // of `aaaaaaaa-` cost 11 seconds, on the path every journal write and every
+        // log line takes. A scheme longer than 30 characters is not one this net is
+        // for, and the cap makes each start position cost a constant.
+        pattern: /\b([a-z][a-z0-9+.-]{0,30}:\/\/[^\s:@/]+):(?!\[REDACTED\]@)[^\s:@/]+@/gi,
+        replace: "$1:[REDACTED]@"
+    },
+    {
+        id: "bearer-token",
+        pattern: /\bBearer\s+[A-Za-z0-9._~+/-]{4,}=*/gi,
+        replace: "Bearer [REDACTED_TOKEN]"
+    },
+    {
+        id: "basic-authorization",
+        pattern: /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}/gi,
+        replace: "Basic [REDACTED_TOKEN]"
+    },
+    {
+        id: "jwt",
+        // Check the three segments once per token before looking for a header.
+        // Starting at every `-eyJ` would rescan a malformed token's entire tail.
+        // Preserve any prefix so a JWT following a hyphen still gets redacted.
+        pattern: /(?<![A-Za-z0-9_-])(?=[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-])([A-Za-z0-9_-]*?)\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+        replace: "$1[REDACTED_TOKEN]"
+    },
+    {
+        id: "api-key",
+        // Not `\b`, for the reason the assignment rule below gives: an underscore
+        // is a word character, so `\bsk` never fires after `ANTHROPIC_` or after
+        // Effect's log-span sanitizer folds `token=` into `token_`. The lookbehind
+        // excludes only letters and digits, so a key still reads as a key when an
+        // underscore or a hyphen runs into it.
+        pattern: /(?<![A-Za-z0-9])(?:sk|pk)[-_][A-Za-z0-9][A-Za-z0-9_-]{7,}/g,
+        replace: "[REDACTED_API_KEY]"
+    },
+    {
+        id: "github-token",
+        pattern: /\bgh[pousr]_[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
+        replace: "[REDACTED]"
+    },
+    {
+        id: "github-fine-grained-token",
+        pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}(?![A-Za-z0-9_])/g,
+        replace: "[REDACTED]"
+    },
+    {
+        id: "aws-access-key",
+        pattern: /\bAKIA[0-9A-Z]{16}\b/g,
+        replace: "[REDACTED]"
+    },
+    {
+        id: "slack-token",
+        pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g,
+        replace: "[REDACTED]"
+    },
+    {
+        id: "google-api-key",
+        pattern: /\bAIza[0-9A-Za-z_-]{35,}(?![0-9A-Za-z_-])/g,
+        replace: "[REDACTED]"
+    },
+    {
+        id: "assignment",
+        // A credential name, `:`, `=` or `=>`, and its whole value: quoted at any
+        // escape depth, a container, or several bare words. See `redactValues`.
+        pattern: credentialNames,
+        rewrite: (text) => redactValues(text, credentialNames, durable)
+    },
+    {
+        id: "credential-flag",
+        // `--password hunter2`, `--api-key "a b"`, or the same pair as two argv
+        // elements. `--token=x` is an assignment above; this is the spelling a
+        // command line separates with a space. The next word is the value even
+        // when it starts with `-`: a credential flag always takes one.
+        pattern: credentialFlag,
+        rewrite: (text) => redactArguments(text, credentialFlag, (match, value) => namesCredential(match[1].replace(/^-+/, ""), value))
+    },
+    {
+        id: "cookie-session-assignment",
+        pattern: /(?<![A-Za-z0-9-])((?:COOKIE|SESSION)S?)(\s*=\s*)(?!\[REDACTED\])("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|(?!["'])[^\s;,]+)/gi,
+        replace: "$1$2[REDACTED]"
+    }
+];
+/**
+ * The rules for a diagnostic: {@link defaultRules} and the spellings too broad
+ * for a durable row.
+ *
+ * A log line, a stderr message, and an error handed to a remote caller are
+ * read once, so a false positive costs a word of context. A journal row is
+ * permanent, so the same false positive destroys data. These rules sit on the
+ * diagnostic side of that line: an authorization header in any scheme, bare
+ * URL userinfo (`https://token@host`), a signed query parameter, and the value
+ * of a `-p` flag, which is a password to `mysql` and `sshpass` and a path to
+ * `mkdir`. A path, a port and a lowercase word attached to `-p` (`-print`,
+ * `-path`) are left alone.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export const diagnosticRules = [
+    ...defaultRules.map((rule) => rule.id === "assignment"
+        ? {
+            id: "assignment",
+            pattern: diagnosticNames,
+            rewrite: (text) => redactValues(text, diagnosticNames, { header: false, diagnostic: true })
+        }
+        : rule),
+    {
+        id: "authorization-header",
+        // The header value is a credential whatever its scheme (`Token`, a cookie
+        // list, `Digest` with quoted parameters), so the value runs to the end of
+        // its line or the close of the string it was written in.
+        // A lookbehind-free superset lets the compiled prefilter skip ordinary prose.
+        pattern: /(?:proxy-)?authorization|(?:set-)?cookies?/gi,
+        rewrite: (text) => redactValues(text, diagnosticHeaderNames, { header: true, diagnostic: true })
+    },
+    {
+        id: "bearer-or-basic",
+        // A token shorter than the default rules' minimum. A lowercase `basic` is
+        // prose ("a basic example"), so only the scheme's own spellings count.
+        pattern: /(\b(?:[Bb]earer|BEARER|Basic|BASIC)\s+)(?!\[REDACTED)[^\s,;"'\\]+/g,
+        replace: "$1[REDACTED]"
+    },
+    {
+        id: "password-flag",
+        // The whole next argument, a path or a leading `-` included.
+        pattern: passwordFlag,
+        rewrite: (text) => redactArguments(text, passwordFlag)
+    },
+    {
+        id: "sshpass-password",
+        // `sshpass -p` always takes a value, even one that starts with `--`,
+        // which `mysql -p --database x` reads as the next option.
+        pattern: /(\bsshpass(?:\s+-[^\sp]\S*){0,8}\s+-p\s+)--(?!\[REDACTED\])[^\s"'`]*/g,
+        replace: "$1[REDACTED]"
+    },
+    {
+        id: "user-flag",
+        // `curl -u user:pass`, `--user=user:pass`, quoted or not: the whole
+        // argument, commas included, when it carries a `:`.
+        pattern: userFlag,
+        rewrite: (text) => redactArguments(text, userFlag, (_match, value) => value.includes(":"))
+    },
+    {
+        id: "header-pair",
+        pattern: headerPair,
+        rewrite: redactHeaderPairs
+    },
+    {
+        id: "command-password-flag",
+        // The whole next argument, whatever it starts with.
+        pattern: commandPasswordFlag,
+        rewrite: (text) => redactArguments(text, commandPasswordFlag)
+    },
+    {
+        id: "url-userinfo",
+        pattern: /(\/\/)(?!\[REDACTED\]@)(?![^/@\s"'\\]*:\[REDACTED\]@)[^/@\s"'\\]+@/g,
+        replace: "$1[REDACTED]@"
+    },
+    {
+        id: "signed-query",
+        pattern: /([?&][\w.-]*(?:key|sig|signature|auth|credential)=)(?!\[REDACTED\])[^&#\s"'\\]+/gi,
+        replace: "$1[REDACTED]"
+    },
+    {
+        id: "short-password-flag",
+        // A path is kept, and so is a flag: `mysql -p --database x` prompts for
+        // the password rather than taking one.
+        pattern: shortPasswordFlag,
+        rewrite: (text) => redactArguments(text, shortPasswordFlag)
+    },
+    {
+        id: "attached-password-flag",
+        // `-psecret`. The single-dash words that start with `p` and are not a
+        // password, `find -print` and the compilers' `-pthread` among them, are kept.
+        pattern: attachedPasswordFlag,
+        rewrite: (text) => redactArguments(text, attachedPasswordFlag)
+    }
+];
+/**
+ * Redacts one diagnostic value with {@link diagnosticRules}: a log line, a
+ * stderr message, an error handed back to a caller.
+ *
+ * Every diagnostic path shares this one function, and it runs on the value
+ * before anything renders or bounds it. Redacting a rendering line by line, or
+ * after a bound, is how a secret escaped: `util.inspect` splits a long string
+ * over several lines, and a bound cuts a quoted value before its closing
+ * quote. A value past {@link maxDepth} is named rather than thrown.
+ *
+ * @since 1.0.0
+ * @category redaction
+ */
+export const redactDiagnostic = (value) => redact(value, { rules: diagnosticRules, onTooDeep: "name" });
+/**
+ * Credential names this module refuses to persist, matched as suffixes of the
+ * separator-free lowercase form of a key.
+ *
+ * The list is the union of the names `packages/smithers/src/Bug.ts` redacts
+ * structurally, because the journal is the PERMANENT side of that pair: a bug
+ * report is one upload an operator reviews before it leaves the machine, while
+ * `flows_journal_events.payload_json` is replayed verbatim to every sync
+ * subscriber and time-travel consumer forever. The journal redacting less than
+ * the report inverts the risk, and it did: `credential`, `credentials`, `dsn`,
+ * and `connectionString` all round-tripped through a durable row in clear.
+ *
+ * Two families are spelled out rather than reduced to a shorter word, because
+ * these are SUFFIX tests: `connectionString` does not end in `connection`, and
+ * `secretKey` does not end in `secret`. A bare `key` suffix is not on the list
+ * for the opposite reason: it would redact `monkey` and `turkey`.
+ *
+ * `signature` stays, and a field it costs is renamed rather than excused. A
+ * name test cannot tell a MAC computed with a secret from a digest over public
+ * input, and both are called `signature`: `WorkspaceShare` signs its claims
+ * with `ShareSigner.signHmac` and that value IS the share's authorization,
+ * `GrantStore` carries envelope signatures, and the GitHub, Linear and
+ * Telegram webhook readers all verify a header by that name. Against those, a
+ * digest whose whole purpose is to be reconciled costs nothing to rename and
+ * everything to leave unreadable -- see
+ * `AgentEvent.VacuousVerificationObserved.callDigest`, which was `signature`
+ * and reached durable rows as the placeholder.
+ */
+const sensitiveKeySuffixes = [
+    "auth",
+    "authorization",
+    "cookie",
+    "apikey",
+    "token",
+    "password",
+    "passphrase",
+    "secret",
+    "secretaccesskey",
+    "credential",
+    "dsn",
+    "connection",
+    "connectionstring",
+    "connectionuri",
+    "connectionurl",
+    "secretkey",
+    "privatekey",
+    "sshkey",
+    "signingkey",
+    "signature",
+    "encryptionkey",
+    "session",
+    "sessionkey"
+];
+/**
+ * A trailing `key` that is a word of its own.
+ *
+ * Read against the ORIGINAL key, where the separators that make `key` a word
+ * still exist: `key`, `api_key`, `x-api-key`, `signing-key`. This is the shape
+ * `packages/smithers/src/Bug.ts` matches, and stopping here is deliberate. Treating
+ * a camel-case hump as a separator too, `/[a-z0-9]Key$/`, looks equivalent and
+ * is not: it redacted `idempotencyKey`, the durable identity an effect boundary
+ * replays on, out of `@smthrs/engine-store`'s journal rows. A credential-named
+ * key is covered by {@link sensitiveKeySuffixes} instead, where the word before
+ * `key` has to be one that names a secret.
+ */
+const trailingKeyWord = /(?:^|[^A-Za-z0-9])key$/i;
+const canonicalKey = (key) => key.toLowerCase().replace(/[^a-z0-9]/g, "").replace(/s$/, "");
+/** Numeric accounting fields that contain counts, never bearer material. */
+const tokenCounterKeys = new Set([
+    "inputtoken",
+    "outputtoken",
+    "cachedinputtoken",
+    "reasoningtoken",
+    "totaltoken"
+]);
+/**
+ * A bare plural `tokens` is a count too: `Envelope.budget.tokens` is the run's
+ * token ceiling, and redacting it erased every journaled budget. A singular
+ * `token` stays bearer material even when it is numeric.
+ */
+const isTokenCount = (key, value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 &&
+    (tokenCounterKeys.has(canonicalKey(key)) || key.toLowerCase() === "tokens");
+/**
+ * Whether a field name names a credential.
+ *
+ * Case and separators are ignored, so `api_key`, `apiKey`, and `x-api-key` are
+ * all recognised, one trailing plural `s` is stripped so `credentials` reads as
+ * `credential`, and a trailing `key` counts where it is a word of its own or
+ * where the word before it names a secret.
+ *
+ * The rule is a suffix test, not a substring test. `tokenizer`, `secretary`,
+ * `monkey`, and `idempotencyKey` are ordinary field names, and replacing their
+ * values would destroy data in a permanent row without protecting anything.
+ * That is the one place this rule is deliberately narrower than
+ * `packages/smithers/src/Bug.ts`'s substring form, which can afford the false
+ * positives because its output is a single report an operator reads once.
+ *
+ * @since 0.1.0
+ * @category predicates
+ */
+export const isSensitiveKey = (key) => {
+    if (trailingKeyWord.test(key))
+        return true;
+    const canonical = canonicalKey(key);
+    return sensitiveKeySuffixes.some((suffix) => canonical.endsWith(suffix));
+};
+const redactMember = (key, value, walk) => isSensitiveKey(key) && !isTokenCount(key, value) ? placeholder : walk(value);
+/**
+ * A field name with a credential in it replaced outright, not rewritten in place.
+ *
+ * Redacting part of a key changes what the key reads as. `secret=sk-` rewrites
+ * to `secret=[REDACTED]`, which now ENDS in a sensitive name, so a second
+ * application would replace a value the first one left alone and redaction
+ * would stop being a fixed point. Naming the whole key holds the verdict still:
+ * `[REDACTED]` matches no rule and names no credential. Two such keys collapse
+ * into one and the later member wins, which is the fidelity trade every other
+ * marker here makes.
+ */
+const redactKey = (key, rules) => {
+    const redacted = redactString(key, rules);
+    return redacted === key ? key : placeholder;
+};
+/**
+ * How many times {@link redactString} re-applies the rules to reach a fixed
+ * point. Rules feed each other: an assignment redacted inside URL userinfo
+ * leaves userinfo the URL rule only then matches. Text no rule touches costs
+ * one pass, and the default rules settle within three. Text that has not
+ * settled after the last pass is replaced whole.
+ */
+const fixedPointPasses = 8;
+/**
+ * A copy of `pattern` that matches wherever `pattern` does, with no
+ * lookbehind, or `null`. JavaScriptCore runs a pattern that has a lookbehind
+ * in its interpreter, 30 to 70 times slower than compiled: 40 kB of prose cost
+ * a Bun process 300 ms per diagnostic, where Node took 1 ms. Text the copy
+ * never matches is text the rule cannot change, so the rule is skipped.
+ *
+ * Only a one-character negative lookbehind that starts the pattern is
+ * rewritten, as a character the copy consumes, which keeps a name scan
+ * starting once per identifier. Anywhere else, after `\b` or inside a
+ * repeated group, the consumed character would make the copy stricter than
+ * the rule, so any other lookbehind or a backreference leaves the rule
+ * unfiltered.
+ */
+const candidate = (pattern) => {
+    const cached = candidates.get(pattern);
+    if (cached !== undefined)
+        return cached;
+    const leading = /^\(\?<!\[(\^?)((?:\\.|[^\]\\])*)\]\)/.exec(pattern.source);
+    const rest = leading === null ? pattern.source : pattern.source.slice(leading[0].length);
+    const compiled = /\(\?<[!=]|\\(?:[1-9]|k<)/.test(rest)
+        ? null
+        : new RegExp(leading === null ? rest : `(?:^|[${leading[1] === "" ? "^" : ""}${leading[2]}])${rest}`, pattern.flags.replace(/[gy]/g, ""));
+    candidates.set(pattern, compiled);
+    return compiled;
+};
+const candidates = new WeakMap();
+const applyRule = (text, rule) => {
+    if (candidate(rule.pattern)?.test(text) === false)
+        return text;
+    return rule.rewrite === undefined ? text.replace(rule.pattern, rule.replace ?? placeholder) : rule.rewrite(text);
+};
+const redactString = (value, rules) => {
+    let text = value;
+    for (let pass = 0; pass < fixedPointPasses; pass++) {
+        const next = rules.reduce(applyRule, text);
+        if (next === text)
+            return text;
+        text = next;
+    }
+    // Rules that never settle would let an exported row keep changing, and
+    // what they left may still hold a credential. Fail closed.
+    return placeholder;
+};
+/**
+ * Maximum number of container edges traversed from a redaction root.
+ *
+ * Journal event schemas never approach 256 nested containers. This bound is
+ * far above practical payloads while keeping traversal safely below Node's
+ * call-stack limit for hostile input.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export const maxDepth = 256;
+/**
+ * A payload nested deeper than {@link maxDepth}, under `onTooDeep: "throw"`.
+ * `code` is always `depth_exceeded`; `maxDepth` is the bound that was crossed.
+ *
+ * @since 1.0.0
+ * @category errors
+ */
+export class RedactionDepthError extends Schema.TaggedError()("@smthrs/journal/RedactionDepthError", { code: Schema.Literal("depth_exceeded"), maxDepth: Schema.Number, message: Schema.String }) {
+    name = "RedactionDepthError";
+}
+/**
+ * How many bytes a view may hold, and how many own members {@link redact} reads
+ * off it, before it stops reading them.
+ *
+ * Enumerating a view's own properties materialises one pair per byte, so the
+ * walk costs the buffer's size even though the rendering does not. Both halves
+ * of the bound carry load, and neither is a bound on its own. A size alone is
+ * not, because `byteLength` was read as an ordinary property and an ordinary
+ * property can be shadowed: a pooled chunk that reports the bytes it has used
+ * rather than the bytes it holds is a plain pattern, not an adversarial one,
+ * and a 4 MB chunk reporting 12 walked one property per byte anyway. A count
+ * alone is not, because a caller can hang a million properties on a ten-byte
+ * view. So the size is read from the value's own internal slot, where nothing
+ * a caller writes can answer for it, and the members are counted as they are
+ * walked.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+export const binaryWalkLimit = 65_536;
+/**
+ * The byte-length getters, taken from the prototypes rather than from a value.
+ *
+ * `%TypedArray%.prototype`, `DataView.prototype` and `ArrayBuffer.prototype`
+ * each define `byteLength` as an accessor over an internal slot, and applying
+ * one to a value that has no such slot throws. Reading the size this way is
+ * therefore a brand check as well as a measurement: a caller's own `byteLength`
+ * property, accessor or not, never answers it.
+ */
+const byteLengthGetters = [
+    Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), "byteLength").get,
+    Object.getOwnPropertyDescriptor(DataView.prototype, "byteLength").get,
+    Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength").get
+];
+/** A value's byte length from its own internal slot, or `undefined` when it has none. */
+const byteLength = (node) => {
+    for (const getter of byteLengthGetters) {
+        try {
+            return Reflect.apply(getter, node, []);
+        }
+        catch {
+            // Not that kind of view. Another getter answers, or none does and the
+            // bytes are named without the members being read.
+        }
+    }
+    return undefined;
+};
+/** The prototypes every binary view inherits from. */
+const binaryPrototypes = new Set([
+    Object.getPrototypeOf(Uint8Array.prototype),
+    DataView.prototype,
+    ArrayBuffer.prototype
+]);
+/** How many prototypes {@link isBinary} climbs before it stops asking. */
+const prototypeWalkLimit = 64;
+/**
+ * Whether `node` is a binary view, including one held behind a proxy.
+ *
+ * `ArrayBuffer.isView` reads an internal slot, and a proxy has none of its own,
+ * so it answers `false` for a proxy over a view. That sent a proxied 2 MB
+ * buffer to the object branch, which rebuilt it one key per byte: 2,000 ms and
+ * 22.9 million characters for one logged value. A proxy forwards
+ * `getPrototypeOf` to its target, so the prototype chain answers where the
+ * brand check cannot. The climb is capped because a proxy is free to hand back
+ * a fresh object every time it is asked, which is an endless chain.
+ */
+const isBinary = (node) => {
+    if (ArrayBuffer.isView(node) || node instanceof ArrayBuffer)
+        return true;
+    try {
+        let prototype = Object.getPrototypeOf(node);
+        for (let step = 0; prototype !== null && step < prototypeWalkLimit; step++) {
+            if (binaryPrototypes.has(prototype))
+                return true;
+            prototype = Object.getPrototypeOf(prototype);
+        }
+    }
+    catch {
+        // A revoked proxy refuses to be asked. It is not a view, and the object
+        // branch names it.
+    }
+    return false;
+};
+/** Own keys of a binary view that name one of its bytes rather than a property. */
+const indexKey = /^(?:0|[1-9][0-9]*)$/;
+/** `Uint8Array 1024 bytes`, or the bare marker when the value will not say. */
+const describeBinary = (node, size) => {
+    if (size === undefined)
+        return binaryMarker;
+    try {
+        return `${node.constructor.name} ${size} bytes`;
+    }
+    catch {
+        return binaryMarker;
+    }
+};
+/**
+ * The key {@link redact} files a binary view's size under.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+export const binaryMarker = "[Binary]";
+/**
+ * What {@link redact} writes in place of a function or a class object.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+export const functionMarker = "[Function]";
+/**
+ * What {@link redact} writes in place of a symbol.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+export const symbolMarker = "[Symbol]";
+/**
+ * What {@link redact} writes past {@link maxDepth} under `onTooDeep: "name"`.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+export const depthMarker = "[Deep]";
+/**
+ * Returns `value` with credentials removed.
+ *
+ * Objects and arrays are rebuilt: a field whose name {@link isSensitiveKey}
+ * is replaced wholesale, every other string is run through the textual rules,
+ * and a cycle is collapsed to `"[Circular]"` so the result always encodes.
+ * A number, a boolean, `null` and `undefined` are returned untouched, because
+ * redacting one destroys data without protecting anything. A function and a
+ * symbol are NAMED, {@link functionMarker} and {@link symbolMarker}: a body, an
+ * own property and a description are all text a renderer prints, and none of it
+ * can be rewritten in place.
+ *
+ * Traversal accepts at most {@link maxDepth} container edges. A deeper value
+ * throws by default, so the journal boundary can report a typed `invalid_event`
+ * instead of overflowing the runtime stack. {@link Options.onTooDeep} set to
+ * `"name"` writes {@link depthMarker} in its place instead, which is what a
+ * logger wants.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+export const redact = (value, options) => {
+    const onTooDeep = options?.onTooDeep ?? "throw";
+    const rules = globalRules(options?.rules ?? defaultRules);
+    /**
+     * A binary view named by its type and size, with its own properties walked.
+     *
+     * Its bytes are not text the rules can read, and rebuilding it from its
+     * entries wrote one key per byte: a 100 kB buffer rendered 1.4 MB. Handing
+     * the view back untouched is not the answer either, because `redact` is the
+     * journal's own write path, so a caller's `apiKey` property hung on a buffer
+     * went into a durable row in clear. Name the bytes, keep walking the text.
+     */
+    const binary = (node, ancestors, depth) => {
+        const size = byteLength(node);
+        // The description is text read off the value, so it meets the rules like
+        // any other text: a class name is caller data, and a view whose
+        // constructor is named after a credential wrote it into a durable row.
+        const entries = [[binaryMarker, redactString(describeBinary(node, size), rules)]];
+        // `Object.entries` on a view materialises one pair per byte before the
+        // index filter can discard them, which cost 312 ms for 1 MB on the journal
+        // write path. Past the bound the bytes are named and nothing else is read,
+        // so a member a caller hung on a large view is dropped rather than shown.
+        // A value that will not answer from its internal slot, such as a proxy over
+        // a view, is named and never enumerated at all.
+        if (size !== undefined && size <= binaryWalkLimit) {
+            let walked = 0;
+            for (const [key, field] of Object.entries(node)) {
+                // An index is one of the bytes just named, not a property a caller set.
+                if (indexKey.test(key))
+                    continue;
+                // The size bounds the bytes, not the properties: a caller can hang a
+                // million members on a ten-byte view, and each one costs three rule
+                // scans over its name and a walk of its value.
+                if (walked >= binaryWalkLimit)
+                    break;
+                walked++;
+                entries.push([
+                    redactKey(key, rules),
+                    redactMember(key, field, (value) => walk(value, ancestors, depth + 1, key))
+                ]);
+            }
+        }
+        // `Object.fromEntries`, not `named[key] = …`, for the reason the object
+        // branch below gives: a literal `__proto__` key would route through the
+        // inherited setter and the member would vanish from the row.
+        return Object.fromEntries(entries);
+    };
+    const walk = (node, ancestors, depth, key) => {
+        if (depth > maxDepth) {
+            if (onTooDeep === "name")
+                return depthMarker;
+            throw new RedactionDepthError({
+                code: "depth_exceeded",
+                maxDepth,
+                message: `redaction depth exceeds ${maxDepth}`
+            });
+        }
+        if (typeof node === "string")
+            return redactString(node, rules);
+        // A function, a class object or a symbol carries text a walk never reaches
+        // (own properties, a description, a body), and the renderer prints it. None
+        // of it can be redacted in place, so the value is named instead.
+        if (typeof node === "function")
+            return functionMarker;
+        if (typeof node === "symbol")
+            return symbolMarker;
+        if (node === null || typeof node !== "object")
+            return node;
+        if (isBinary(node))
+            return binary(node, ancestors, depth);
+        if (ancestors.has(node))
+            return "[Circular]";
+        // A journal row is bounded by its schema, but a LOGGED value is arbitrary:
+        // the logger sends every non-Error value here, and a chain deep enough to
+        // exhaust the stack would throw while the line is rendering, killing the
+        // run the line describes. Past the cap the value is named, the way a cycle
+        // is named.
+        ancestors.add(node);
+        try {
+            const toJSON = node.toJSON;
+            // JSON.stringify passes the containing key (or "" at the root) to toJSON.
+            // Reuse it when walking the replacement; siblings may share this object.
+            if (typeof toJSON === "function")
+                return walk(toJSON.call(node, key), ancestors, depth, key);
+            if (Array.isArray(node)) {
+                // `map` invokes the input's species constructor, which can restore
+                // credential fields and inspection hooks after the elements are walked.
+                // Rebuild a plain array, preserving the original length and holes.
+                const length = node.length;
+                const result = new Array(length);
+                const elements = new Array(length);
+                for (let index = 0; index < length; index++) {
+                    if (!(index in node))
+                        continue;
+                    elements[index] = node[index];
+                    result[index] = walk(elements[index], ancestors, depth + 1, String(index));
+                }
+                // An argv keeps a flag and its value in two elements, so no rule sees
+                // `--password hunter2` whole. The element after a flag is a credential
+                // when its name says so (`--token=x` carries its own, and a count under
+                // `--max-tokens` is kept), or when the active rules redact it read
+                // after the flag and the elements before it (`-p`, `-pw`, `-passin`,
+                // `sshpass -p`) differently than alone.
+                for (let index = 0; index + 1 < length; index++) {
+                    // The values the first loop read, never a second read: a proxy may
+                    // answer a second `get` differently.
+                    const flag = elements[index];
+                    const value = elements[index + 1];
+                    if (typeof flag !== "string" || typeof value !== "string" || !/^-[^=\s]+$/.test(flag))
+                        continue;
+                    const name = flag.replace(/^-+/, "");
+                    const before = elements.slice(Math.max(0, index - 3), index + 1).filter((element) => typeof element === "string").join(" ");
+                    const consumes = (isSensitiveKey(name) && namesCredential(name, value)) ||
+                        redactString(`${before} ${value}`, rules) !== `${redactString(before, rules)} ${redactString(value, rules)}`;
+                    if (consumes)
+                        result[index + 1] = placeholder;
+                }
+                return result;
+            }
+            // `result[key] = …` routes a literal `__proto__` key through the
+            // inherited setter, so the field would silently become the result's
+            // prototype instead of a member: the payload loses data and redaction
+            // stops being a fixed point. `Object.fromEntries` defines own data
+            // properties and has no such hole.
+            return Object.fromEntries(Object.entries(node).map(([key, field]) => [
+                // The KEY is text too. Rewriting only values let a credential used as
+                // a log annotation key reach the operator, since Effect renders an
+                // annotation as `key=value`, and become an OTLP span attribute name.
+                redactKey(key, rules),
+                redactMember(key, field, (value) => walk(value, ancestors, depth + 1, key))
+            ]));
+        }
+        finally {
+            ancestors.delete(node);
+        }
+    };
+    return walk(value, new WeakSet(), 0, "");
+};
+/**
+ * Builds a redactor over a rule set.
+ *
+ * @since 0.1.0
+ * @category constructors
+ */
+export const make = (options) => (value) => redact(value, options);
+/**
+ * Applies a redactor to an already-encoded JSON string, returning the
+ * re-encoded result.
+ *
+ * For export and display surfaces that hold a column verbatim, a rendered
+ * `state_json`, a support bundle, where the value is already encoded and must
+ * not be decoded into the executable path. A string that does not parse is
+ * returned untouched: validation is the caller's, and rejecting here would
+ * turn a redaction concern into a schema error. Once parsing succeeds, a
+ * throwing redactor or an encoding failure returns the valid JSON string
+ * `"[REDACTED]"`; the original parsed text is never returned.
+ *
+ * @since 0.1.0
+ * @category redaction
+ */
+export const redactJsonString = (json, redactor) => {
+    const decoded = Schema.decodeUnknownResult(UnknownFromJsonString)(json);
+    if (Result.isFailure(decoded))
+        return json;
+    const attempted = Result.try(() => Schema.encodeUnknownResult(UnknownFromJsonString)(redactor(decoded.success)));
+    if (Result.isFailure(attempted))
+        return JSON.stringify(placeholder);
+    return Result.isSuccess(attempted.success) ? attempted.success.success : JSON.stringify(placeholder);
+};
+/**
+ * Lines a {@link lineRedactor} holds for one open value. Past this, or past
+ * 64 KiB, it stops holding: it emits what it held, redacted, and withholds
+ * every later line until the stream ends, when one placeholder stands for
+ * them. Dropping lines from the middle instead changed which brackets and
+ * quotes were open, and released a later secret in clear.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export const maxHeldLines = 256;
+const maxHeldBytes = 64 * 1024;
+/** Held lines a {@link lineRedactor} asks about one by one before it asks only as the block grows by half. */
+const eagerHeldLines = 16;
+/**
+ * The most brackets and strings the dropped middle of an overlong line may
+ * leave open before a {@link lineRedactor} stops reading it and treats the
+ * line as leaving a value open. Without it the middle's state grew by one
+ * entry per bracket: 32 MiB of `[` held 1.7 GB (#3088).
+ */
+const maxDroppedDepth = 1024;
+/**
+ * The longest line a {@link lineRedactor} reads whole. A longer line keeps
+ * its first and last 16 KiB; its middle is scanned for what it leaves open
+ * and dropped.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export const maxPartialLine = 32 * 1024;
+/**
+ * What a {@link lineRedactor} emits in place of a line longer than
+ * {@link maxPartialLine}.
+ *
+ * @since 1.0.0
+ * @category constants
+ */
+export const omittedLine = "[overlong line omitted]";
+/**
+ * A next line no rule redacts alone, which an open value swallows. The value
+ * is open when the redacted text no longer ENDS with it: text before it may
+ * contain the same word.
+ */
+const continuationProbe = "\n'probe'";
+/** Rules with the global flag each rule needs to replace every match. */
+const globalRules = (rules) => rules.map((rule) => rule.pattern.flags.includes("g")
+    ? rule
+    : { ...rule, pattern: new RegExp(rule.pattern.source, `${rule.pattern.flags}g`) });
+/**
+ * A redactor for a stream that must be emitted line by line: a live build
+ * log, a child's stderr.
+ *
+ * Redacting each line alone is the flaw that leaked a private key's body, and
+ * the tail of every string `util.inspect` split over several lines: only the
+ * line holding the name was redacted. This one asks the rules themselves
+ * whether a line leaves a value open, by checking whether the value swallows
+ * a probe placed on the next line, and holds lines until it closes. The held
+ * block is then redacted whole, exactly as {@link redact} redacts a string.
+ *
+ * A line longer than {@link maxPartialLine} is read as its first and last
+ * 16 KiB. Its middle is dropped, but a bracket, quote or key block the middle
+ * leaves open would have opened a value the kept ends cannot show, so then
+ * the rest of the stream is withheld. Such a line is never emitted, only
+ * {@link omittedLine}, and neither is any block it was held in.
+ *
+ * Its state is bounded whatever the stream does: the line still arriving is
+ * a 16 KiB head, a 16 KiB tail and at most 1024 open brackets or strings of
+ * its middle, a middle nested deeper counting as one left open; the held
+ * block is bounded by {@link maxHeldLines} and 64 KiB. Its cost is linear:
+ * past the first 16 held lines the block is re-read only once it has grown
+ * by half, on Node and on Bun alike (#3088).
+ *
+ * `rules` defaults to {@link diagnosticRules}. The array is read on every
+ * line, so a caller may add a rule, a session secret, as the stream runs.
+ *
+ * @since 1.0.0
+ * @category constructors
+ */
+export const lineRedactor = (rules = diagnosticRules) => {
+    const held = [];
+    let heldBytes = 0;
+    let askAt = 0;
+    let heldOverlong = false;
+    let withheld = false;
+    // The line still arriving: whole up to the bound, then a head, a rolling
+    // tail, and what the dropped middle leaves open.
+    const edge = maxPartialLine / 2;
+    let head = "";
+    let tail = "";
+    let overlong = false;
+    let middle = [];
+    let middleDeep = false;
+    let middleKey = false;
+    let carry = "";
+    const resetPartial = () => {
+        head = "";
+        tail = "";
+        overlong = false;
+        middle = [];
+        middleDeep = false;
+        middleKey = false;
+        carry = "";
+    };
+    const scanDropped = (dropped) => {
+        // What the middle leaves open is read in slices, and once it is nested
+        // past `maxDroppedDepth` it is not read at all: the line is then already
+        // risky, and the stack held one entry per bracket of a line of any length.
+        for (let from = 0; from < dropped.length && !middleDeep; from += edge) {
+            track(middle, dropped, from, Math.min(dropped.length, from + edge));
+            if (middle.length > maxDroppedDepth) {
+                middleDeep = true;
+                middle = [];
+            }
+        }
+        const seen = carry + dropped;
+        const begin = seen.search(/-----BEGIN[^-]*PRIVATE KEY/);
+        const lastBegin = seen.lastIndexOf("-----BEGIN");
+        const lastEnd = seen.lastIndexOf("-----END");
+        if (begin !== -1 || lastEnd !== -1)
+            middleKey = lastBegin > lastEnd;
+        carry = seen.slice(-64);
+    };
+    const redacted = (text) => redactString(text, globalRules(rules));
+    const release = () => {
+        const text = redacted(held.join("\n"));
+        const overlongBlock = heldOverlong;
+        held.length = 0;
+        heldBytes = 0;
+        askAt = 0;
+        heldOverlong = false;
+        return overlongBlock ? [omittedLine] : text.split("\n");
+    };
+    const part = (text) => {
+        if (withheld)
+            return;
+        if (!overlong) {
+            head += text;
+            if (head.length <= maxPartialLine)
+                return;
+            overlong = true;
+            tail = head.slice(edge);
+            head = head.slice(0, edge);
+        }
+        else
+            tail += text;
+        if (tail.length > edge) {
+            scanDropped(tail.slice(0, tail.length - edge));
+            tail = tail.slice(-edge);
+        }
+    };
+    const line = (rest) => {
+        if (withheld) {
+            resetPartial();
+            return [];
+        }
+        part(rest);
+        let text = head;
+        if (overlong) {
+            const risky = middle.length > 0 || middleDeep || middleKey;
+            text = `${head} ${tail}`;
+            resetPartial();
+            if (risky) {
+                const before = held.length === 0 ? [] : [placeholder];
+                held.length = 0;
+                heldBytes = 0;
+                askAt = 0;
+                heldOverlong = false;
+                withheld = true;
+                return [...before, omittedLine];
+            }
+            heldOverlong = true;
+        }
+        else
+            resetPartial();
+        held.push(text);
+        heldBytes += text.length + 1;
+        // Asking after every line re-redacted the whole block per line, so a
+        // block of n bytes cost n² (#3088). Past the first lines the question is
+        // asked again only once the block has grown by half, which keeps the
+        // cost linear; a block that closed in between is released with the
+        // lines after it, redacted as one block, which hides no less.
+        if (held.length <= eagerHeldLines || heldBytes >= askAt) {
+            if (redacted(held.join("\n") + continuationProbe).endsWith(continuationProbe))
+                return release();
+            askAt = heldBytes + (heldBytes >> 1);
+        }
+        if (held.length <= maxHeldLines && heldBytes <= maxHeldBytes)
+            return [];
+        withheld = true;
+        return release();
+    };
+    const peek = () => {
+        if (withheld)
+            return [placeholder];
+        const pending = overlong ? [omittedLine] : head === "" ? [] : [head];
+        if (heldOverlong)
+            return [omittedLine];
+        const text = [...held, ...(overlong ? [] : pending)];
+        const out = text.length === 0 ? [] : redacted(text.join("\n")).split("\n");
+        return overlong ? [...out, omittedLine] : out;
+    };
+    return {
+        line,
+        part,
+        peek,
+        flush: () => {
+            const out = head !== "" || overlong ? [...line("")] : [];
+            if (withheld) {
+                withheld = false;
+                return [...out, placeholder];
+            }
+            return held.length === 0 ? out : [...out, ...release()];
+        }
+    };
+};
+/**
+ * The identity redactor, for a caller that persists payloads verbatim by
+ * choice: a trusted single-tenant store, or a suite asserting on raw input.
+ *
+ * @since 0.1.0
+ * @category constructors
+ */
+export const makeNoop = () => (value) => value;
+//# sourceMappingURL=Redaction.js.map