@smthrs/journal 1.0.0-rc.6 → 1.0.0-rc.8

package/docs/concepts/redaction.md

@@ -31,13 +31,14 @@ not a substring test, so `tokenizer`, `secretary`, `monkey`, and
 `idempotencyKey` stay intact. Redacting them would destroy data in a permanent
 row without protecting anything, and `idempotencyKey` in particular is the
 durable identity an effect boundary replays on. Token counters are kept too: a
-non-negative safe integer under `inputTokens`, `outputTokens`,
-`cachedInputTokens`, `reasoningTokens`, or `totalTokens` is accounting, not
-bearer material.
+non-negative safe integer under any name ending in a plural `tokens`
+(`inputTokens`, `cacheWriteTokens`, `max_tokens`) or under `inputToken`,
+`outputToken`, `cachedInputToken`, `reasoningToken`, or `totalToken` is
+accounting, not bearer material. A bare `token` is redacted even when numeric.
 
 **Textual.** `Redaction.defaultRules` scans inside any string for credential
-shapes seen in real bug reports: provider keys, bearer tokens, GitHub, AWS,
-Slack, and Google credentials, URL passwords, Basic authorization, bare JWTs,
+shapes seen in real bug reports: provider keys, bearer tokens, GitHub, GitLab, npm,
+AWS, Slack (tokens and webhook URLs), and Google credentials, URL passwords, Basic authorization, bare JWTs,
 PEM private-key blocks, INI/YAML credential assignments such as
 `SECRET = value` and `password: value`, credential flags such as
 `--password value`, cookie and session assignments, and embedded JSON
@@ -63,6 +64,9 @@ and a count under a plural `tokens` name (`max_tokens: 4096`) is kept.
 A credential name that is a URL's user
 (`https://x-access-token:…@github.com/acme/app.git`) takes only the password
 before `@`, so the host and path a failed clone is diagnosed by are kept.
+A URL password runs to the last `@` before the host, as a URL parser reads it,
+so `redis://:pa:ss@cache` and `mysql://root:p@ss@db` lose the whole password,
+and a URL with no password (`ssh://git@host`) is unchanged.
 
 In a journal row a bare value is one token, and a string or container the text
 never closes stops at the end of its line: a stray backtick in an agent's

package/docs/installation.md

@@ -7,7 +7,11 @@ sidebar:
 
 ## Install the package
 
-Not on npm yet; see [Installation](https://github.com/smithersai/smithers/blob/main/packages/smithers/flows/flow/docs/installation.md#use-the-libraries).
+```bash
+npm install @smthrs/journal@next effect
+```
+
+The `next` tag carries the 1.0 release candidates.
 
 The package requires Node.js 26.4.0 or later and ships as both ESM and
 CommonJS with TypeScript declarations. Its only runtime dependencies are

package/docs/quickstart.md

@@ -17,10 +17,13 @@ redacted.
 
 - Node.js 26.4.0 or later, where the built-in SQLite module lives.
 - An ESM package (`"type": "module"`, because the program ends in a top-level
-  `await`) with the journal, the database it writes through, and `effect`
-  installed. See [Installation](./installation.md) for the `effect` range.
+  `await`) with the journal, the database it writes through, its Node SQLite
+  driver, and `effect` installed. See [Installation](./installation.md) for the
+  `effect` range.
 
-Not on npm yet; see [Installation](https://github.com/smithersai/smithers/blob/main/packages/smithers/flows/flow/docs/installation.md#use-the-libraries).
+```bash
+npm install @smthrs/journal@next @smthrs/database@next @effect/sql-sqlite-node effect
+```
 
 ## Compose the layer
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@smthrs/journal",
   "type": "module",
-  "version": "1.0.0-rc.6",
+  "version": "1.0.0-rc.8",
   "license": "MIT",
   "smthrs": {
     "group": "engine"
@@ -226,14 +226,14 @@
     "tag": "next"
   },
   "dependencies": {
-    "@smthrs/database": "1.0.0-rc.6"
+    "@smthrs/database": "1.0.0-rc.8"
   },
   "devDependencies": {
     "@effect/language-service": "0.87.2",
     "@effect/sql-sqlite-node": "4.0.4",
     "@effect/vitest": "4.0.4",
     "@eslint/js": "9.39.5",
-    "@smthrs/flow": "1.0.0-rc.6",
+    "@smthrs/flow": "1.0.0-rc.8",
     "@types/node": "26.4.1",
     "@vitest/coverage-v8": "5.0.0",
     "dprint": "0.57.1",
@@ -254,7 +254,7 @@
     "effect": "^4.0.4"
   },
   "scripts": {
-    "lint": "eslint src --max-warnings=0 && dprint check",
+    "lint": "eslint src examples --max-warnings=0 && dprint check",
     "format": "dprint fmt",
     "build": "node scripts/build.mjs",
     "check": "tsc -b tsconfig.json && tsc -p tsconfig.test.json --noEmit",

package/src/Redaction.ts

@@ -779,7 +779,14 @@ export const defaultRules: ReadonlyArray<Rule> = [
     // of `aaaaaaaa-` cost 11 seconds, on the path every journal write and every
     // log line takes. A scheme longer than 30 characters is not one this net is
     // for, and the cap makes each start position cost a constant.
-    pattern: /\b([a-z][a-z0-9+.-]{0,30}:\/\/[^\s:@/]+):(?!\[REDACTED\]@)[^\s:@/]+@/gi,
+    //
+    // The username may be empty (`redis://:password@host`), and the password
+    // runs to the LAST `@` before the authority ends, as a URL parser reads
+    // it: RFC 3986 allows `:` in a password and a raw `@` is common in
+    // connection strings. Stopping at the first `:` or `@` left the tail of
+    // such a password in the row. Quotes and backslashes end the scan so a
+    // URL inside JSON text never swallows the next string.
+    pattern: /\b([a-z][a-z0-9+.-]{0,30}:\/\/[^\s:@/]*):(?!\[REDACTED\]@)[^\s/?#"'`\\]*@/gi,
     replace: "$1:[REDACTED]@"
   },
   {
@@ -836,6 +843,23 @@ export const defaultRules: ReadonlyArray<Rule> = [
     pattern: /\bAIza[0-9A-Za-z_-]{35,}(?![0-9A-Za-z_-])/g,
     replace: "[REDACTED]"
   },
+  {
+    id: "gitlab-token",
+    pattern: /\bglpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    replace: "[REDACTED]"
+  },
+  {
+    id: "npm-token",
+    pattern: /\bnpm_[A-Za-z0-9]{36}(?![A-Za-z0-9])/g,
+    replace: "[REDACTED]"
+  },
+  {
+    // The webhook path is the whole credential: anyone holding it can post
+    // to the channel. The host stays so a failed delivery is still readable.
+    id: "slack-webhook",
+    pattern: /(\bhooks\.slack\.com\/services\/)T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g,
+    replace: "$1[REDACTED]"
+  },
   {
     id: "assignment",
     // A credential name, `:`, `=` or `=>`, and its whole value: quoted at any
@@ -1056,13 +1080,16 @@ const tokenCounterKeys: ReadonlySet<string> = new Set([
 ])
 
 /**
- * A bare plural `tokens` is a count too: `Envelope.budget.tokens` is the run's
- * token ceiling, and redacting it erased every journaled budget. A singular
- * `token` stays bearer material even when it is numeric.
+ * Any name ending in a plural `tokens` holds a count too, the rule the textual
+ * pass applies in {@link namesCredential}: `Envelope.budget.tokens` is the
+ * run's token ceiling, and `usage.cacheWriteTokens`, `maxTokens`, and
+ * `contextWindowTokens` are accounting; redacting them erased every journaled
+ * budget and cache-write count (#3846). A bare singular `token` stays bearer
+ * material even when it is numeric.
  */
 const isTokenCount = (key: string, value: unknown): boolean =>
   typeof value === "number" && Number.isSafeInteger(value) && value >= 0 &&
-  (tokenCounterKeys.has(canonicalKey(key)) || key.toLowerCase() === "tokens")
+  (tokenCounterKeys.has(canonicalKey(key)) || /tokens$/i.test(key))
 
 /**
  * Whether a field name names a credential.