@snagset/server 0.0.1

package/dist/vendor/types/names.js

@@ -0,0 +1,254 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// GENERATED FILE — DO NOT EDIT BY HAND.
+// Source of truth: packages/types/registry.json
+// Regenerate:      pnpm gen:names      (CI runs `pnpm gen:names:check`)
+//
+// The Name Registry (specs/00-foundations.md §2) made executable. Every token
+// below is DERIVED from registry.json's `brand` block — the product name lives
+// in exactly one place. test/rename.test.ts proves it: flip the brand, and no
+// token of the old one survives. SCHEMA_VERSION is the one deliberate literal.
+// ─────────────────────────────────────────────────────────────────────────────
+/** The one place the product name exists. Everything else derives from this. */
+export const BRAND = {
+    $comment: "The ONLY place the product name appears. `long` = display/global name. `short` = the terse prefix that goes on attributes, classes, params, storage keys and artefact filenames (a client's DOM should not carry a long word). `pkg` = the npm/lowercase form used for env vars, headers, metrics, DOM events and symbols.",
+    long: "Snagset",
+    short: "snag",
+    pkg: "snagset",
+};
+export const PRODUCT = "Snagset";
+export const NPM_PACKAGE = "snagset";
+export const NPM_SCOPE = "@snagset";
+/** Frozen once v1 stores real data — stamped into exports, issue bodies and the MCP contract, so it must survive a rename (registry.frozen). */
+export const SCHEMA_VERSION = "snagset.v1";
+export const CSS_VAR_PREFIX = "--snag-";
+export const HTTP_HEADER_PREFIX = "x-snagset-";
+export const ENV_PREFIX = "SNAGSET_";
+export const PG_TYPE_PREFIX = "snag_";
+export const METRIC_PREFIX = "snagset_";
+export const DOM_EVENT_PREFIX = "snagset:";
+export const SYMBOL_PREFIX = "snagset.";
+export const MENTION_SCHEME = "snag:user/";
+export const SKIP_HEADER = "x-snagset-skip";
+export const THREAD_REF_PREFIX = "SN-";
+export const TERM_SET = "Snagset";
+export const TERM_SET_PLURAL = "Snagsets";
+export const TERM_ITEM = "Snag";
+export const TERM_ITEM_PLURAL = "Snags";
+export const RESERVED_CUSTOM_PREFIX = "cr.";
+/** @returns e.g. `x-snagset-idempotency-key` */
+export const header = (name) => HTTP_HEADER_PREFIX + name;
+/** @returns e.g. `SNAGSET_SESSION_TTL_S` */
+export const env = (name) => ENV_PREFIX + name;
+/** @returns e.g. `snag_attachment_kind` */
+export const pgType = (name) => PG_TYPE_PREFIX + name;
+/** @returns e.g. `snagset_http_requests_total` */
+export const metric = (name) => METRIC_PREFIX + name;
+/** window.* names (§2.2). Dunders are internal/test affordances, not public API. */
+export const GLOBALS = {
+    api: "Snagset",
+    config: "SnagsetConfig",
+    disabled: "__SNAGSET_DISABLED__",
+    assetBase: "__SNAGSET_ASSET_BASE__",
+    collisionFallback: "__snagset__",
+};
+const scriptAttrToken = {
+    site: "data-snag-site",
+    host: "data-snag-host",
+    disabled: "data-snag-disabled",
+    env: "data-snag-env",
+    mode: "data-snag-mode",
+    badge: "data-snag-badge",
+    lang: "data-snag-lang",
+    theme: "data-snag-theme",
+    position: "data-snag-position",
+    offset: "data-snag-offset",
+    assetBase: "data-snag-asset-base",
+    branch: "data-snag-branch",
+    build: "data-snag-build",
+    storage: "data-snag-storage",
+    hotkey: "data-snag-hotkey",
+    allowAutomation: "data-snag-allow-automation",
+    screenshots: "data-snag-screenshots",
+    maskSelectors: "data-snag-mask-selectors",
+    nonce: "data-snag-nonce",
+    autoMount: "data-snag-auto-mount",
+};
+export const scriptAttr = (name) => scriptAttrToken[name];
+const widgetAttrToken = {
+    root: "data-snag-root",
+};
+export const widgetAttr = (name) => widgetAttrToken[name];
+const hostAttrToken = {
+    anchor: "data-snag-anchor",
+    ignore: "data-snag-ignore",
+    mask: "data-snag-mask",
+    nomask: "data-snag-nomask",
+    src: "data-snag-src",
+    component: "data-snag-component",
+};
+export const hostAttr = (name) => hostAttrToken[name];
+const cssClassToken = {
+    mask: "snag-mask",
+    block: "snag-block",
+};
+export const cssClass = (name) => cssClassToken[name];
+/** Custom properties (§2.1's prefix, enumerated). 06 §14 makes every one of these public SemVer surface, so they are registered rather than minted at the point of use. Values are NOT here — the registry governs names, never design. */
+export const CSS_VAR = {
+    font: "--snag-font",
+    accent: "--snag-accent",
+    onAccent: "--snag-onAccent",
+    bg: "--snag-bg",
+    fg: "--snag-fg",
+    muted: "--snag-muted",
+    border: "--snag-border",
+    radius: "--snag-radius",
+    shadow: "--snag-shadow",
+    z: "--snag-z",
+    motion: "--snag-motion",
+    surface: "--snag-surface",
+    sunken: "--snag-sunken",
+    hover: "--snag-hover",
+    focus: "--snag-focus",
+    disabled: "--snag-disabled",
+    statusOpen: "--snag-status-open",
+    statusProgress: "--snag-status-progress",
+    statusReview: "--snag-status-review",
+    statusResolved: "--snag-status-resolved",
+    anchorOrphan: "--snag-anchor-orphan",
+    tbH: "--snag-tb-h",
+    dockW: "--snag-dock-w",
+    kb: "--snag-kb",
+    thumbX: "--snag-thumb-x",
+    thumbW: "--snag-thumb-w",
+};
+/** Which tokens belong to which role — the dark block must override theme members only. */
+export const CSS_VAR_GROUPS = {
+    theme: ["font", "accent", "onAccent", "bg", "fg", "muted", "border", "radius", "shadow", "z", "motion"],
+    derived: ["surface", "sunken", "hover", "focus", "disabled"],
+    status: ["statusOpen", "statusProgress", "statusReview", "statusResolved"],
+    anchor: ["anchorOrphan"],
+    geometry: ["tbH", "dockW", "kb", "thumbX", "thumbW"],
+};
+/** @returns e.g. `--snag-bg` */
+export const cssVar = (name) => CSS_VAR[name];
+/** @returns e.g. `var(--snag-bg)` — what stylesheets actually interpolate. */
+export const cssRef = (name) => `var(${CSS_VAR[name]})`;
+/** @returns e.g. `snag_t`. The review-link secret is a FRAGMENT param (§2.5). */
+export const param = (name) => "snag_" + name;
+export const RESERVED_URL_PARAMS = {
+    query: ["snag_t", "snag_off", "snag_debug", "snag_theme"],
+    fragment: ["snag_k"],
+};
+/** Point consts for hot paths: a chunk needing ONE key imports it and
+ *  drops the whole table — object properties cannot tree-shake, and the
+ *  panels chunk was carrying ten keys to read two (M2-13). */
+export const DISCLOSURE_KEY = "snag:disclosure:v1";
+export const IDENTITY_KEY = "snag:identity";
+export const THEME_ATTR = "data-snag-theme";
+/** Web-storage keys (§2.6). Parameterised keys are functions. */
+export const storageKey = {
+    session: (uid) => `snag:session:${uid}`,
+    identity: IDENTITY_KEY,
+    threads: (uid, env) => `snag:threads:${uid}:${env}`,
+    counts: (origin) => `snag:counts:${origin}`,
+    draft: (route, draftId) => `snag:draft:${route}:${draftId}`,
+    outbox: (uid) => `snag:outbox:${uid}`,
+    mode: "snag:mode",
+    handoff: "snag:handoff",
+    seenCoach: "snag:seen-coach",
+    disclosure: DISCLOSURE_KEY,
+};
+/** The v0.1 IndexedDB blob store (§2.6, 05 §10.1) — one database, one
+ *  object store, shared by screenshots, reviewer images and the v2 outbox. */
+export const IDB = {
+    database: "snag:blobs",
+    store: "blobs",
+};
+/** Anchored regex sources matching every registered key — AC-22's storage diff. */
+export const STORAGE_KEY_PATTERNS = [
+    "^snag:session:.+$",
+    "^snag:identity$",
+    "^snag:threads:.+:.+$",
+    "^snag:counts:.+$",
+    "^snag:draft:.+:.+$",
+    "^snag:outbox:.+$",
+    "^snag:mode$",
+    "^snag:handoff$",
+    "^snag:seen-coach$",
+    "^snag:disclosure:v1$",
+];
+/** The WIDGET's two (§2.7). Neither carries a credential, and no cookie authenticates the widget API — it runs on somebody else's origin. */
+export const COOKIE = {
+    off: "snag_off",
+    on: "snag_on",
+};
+/** The dashboard's session + CSRF pair (05 §4.7) — first-party, on the server's own origin, owner audience. */
+export const DASHBOARD_COOKIE = {
+    session: "snag_session",
+    csrf: "snag_csrf",
+};
+/** 05 §4.7 names these two constants directly; both spellings resolve to the same string. */
+export const DASHBOARD_SESSION_COOKIE = DASHBOARD_COOKIE.session;
+export const DASHBOARD_CSRF_COOKIE = DASHBOARD_COOKIE.csrf;
+/** Built widget chunks (§2.8). Preact lives only in `panels`. */
+export const ARTIFACT = {
+    stub: "snag.js",
+    runtime: "snag.runtime.js",
+    panels: "snag.panels.js",
+    crumbs: "snag.crumbs.js",
+    capture: "snag.capture.js",
+    screenshot: "snag.screenshot.js",
+    anchorExt: "snag.anchor-ext.js",
+    anchorFuzzy: "snag.anchor-fuzzy.js",
+    dock: "snag.dock.js",
+    text: "snag.text.js",
+};
+/** Wire-form entity id prefixes (§2.10). Not brand-derived. */
+export const ID_PREFIX = {
+    project: "prj_",
+    thread: "thr_",
+    comment: "cmt_",
+    reviewer: "rev_",
+    attachment: "att_",
+    link: "lnk_",
+    round: "rnd_",
+};
+/** Credential literals (07 §8.2). Brand-DERIVED, and deliberately not the three-letter row shape: the literal is what gets registered with secret scanning, so a token pasted into a public repo is reported. */
+export const CREDENTIAL_PREFIX = {
+    mcp: "snagmcp_",
+};
+/** CustomEvents dispatched on document (§2.11). */
+export const DOM_EVENT = {
+    ready: "snagset:ready",
+    activate: "snagset:activate",
+    deactivate: "snagset:deactivate",
+    threadCreated: "snagset:thread-created",
+    threadResolved: "snagset:thread-resolved",
+};
+/** Request/response header names inside §2.1's prefix (05 §2.3). */
+export const HTTP_HEADER = {
+    client: "x-snagset-client",
+    schema: "x-snagset-schema",
+    idempotencyKey: "x-snagset-idempotency-key",
+    identity: "x-snagset-identity",
+    csrf: "x-snagset-csrf",
+    attachmentKind: "x-snagset-attachment-kind",
+    attachmentWidth: "x-snagset-attachment-width",
+    attachmentHeight: "x-snagset-attachment-height",
+    server: "x-snagset-server",
+    minClient: "x-snagset-min-client",
+    time: "x-snagset-time",
+    configVersion: "x-snagset-config-version",
+    idempotentReplay: "x-snagset-idempotent-replay",
+    requestId: "x-snagset-request-id",
+};
+/** Host-authored `<meta name>` keys we READ and never mint (§2.11). 03 §5.3: `route` is the only one. */
+export const META_NAME = {
+    route: "snagset:route",
+};
+/** Keys for Symbol.for() patch bookkeeping (§2.11). */
+export const SYMBOL_KEY = {
+    original: "snagset.original",
+    wrapped: "snagset.wrapped",
+    instance: "snagset.instance",
+};

package/dist/vendor/widget/object.js

@@ -0,0 +1,38 @@
+import { isSensitiveKey, redactText, redactUrl } from "./predicates.js";
+/**
+ * `redactObject` — 04 §4.5's rule for `Breadcrumb.data` (v0.1) and, later,
+ * `CaptureContext.custom` (v1): **key-first, then `redactText` on every leaf,
+ * URL-shaped leaves via `redactUrl`**.
+ *
+ * Key-first matters because the value under a bad key is often innocent-LOOKING
+ * — `{ password: "hunter2" }` has a value no shape rule would flag, and the key
+ * is the only evidence. When the key condemns it, the whole value goes,
+ * whatever its type: an object under `credentials:` is not walked for salvage.
+ *
+ * A SEPARATE FILE from predicates.ts, deliberately: the runtime re-exports the
+ * three predicate functions as resident surface (D48 residency), and keeping
+ * the walker out of that module means its bytes can never ride into the
+ * activation envelope on the strength of a re-export. Chunks that need it —
+ * crumbs, capture — bundle it from this one source.
+ *
+ * Depth and size discipline belongs to the SERIALIZER (04 §3.6b) — by the time
+ * data reaches here it is already bounded. The walker still carries its own
+ * depth stop so a caller who skips the serializer cannot make it spin.
+ */
+const URLISH = /^https?:\/\//i;
+const MARK = "[redacted]";
+export function redactObject(v, depth = 4) {
+    if (typeof v === "string")
+        return URLISH.test(v) ? redactUrl(v) : redactText(v);
+    if (v === null || typeof v !== "object")
+        return v; // numbers, booleans, undefined pass
+    if (depth <= 0)
+        return MARK; // deeper than the serializer allows — refuse, don't trust
+    if (Array.isArray(v))
+        return v.map((item) => redactObject(item, depth - 1));
+    const out = {};
+    for (const [k, val] of Object.entries(v)) {
+        out[k] = isSensitiveKey(k) ? MARK : redactObject(val, depth - 1);
+    }
+    return out;
+}

package/dist/vendor/widget/predicates.js

@@ -0,0 +1,377 @@
+import { RESERVED_URL_PARAMS } from "../types/names.js";
+/**
+ * The redaction module (04 §4).
+ *
+ * 04 §4.1: "Redaction is not optional and cannot be disabled — only *extended*.
+ * There is no `redact: false`." v0 ships `redactText`, `redactUrl`, every shape
+ * rule in §4.3 and `isSensitiveValue` — because `CaptureContext.url` needs the
+ * first two and 03's selector generation needs the third. `redactObject` and the
+ * record-time pipeline arrive with breadcrumbs in v0.1.
+ *
+ * ── Why this file lives in the RUNTIME chunk ──
+ *
+ * 04 §1 says the module lives in `snag.capture.js`. It cannot at v0: 06 §1.1
+ * tags that artefact v0.1 so it does not exist, AC-P15 forbids activation
+ * fetching any capture chunk, and 03's `createElementAnchor` calls
+ * `isSensitiveValue` SYNCHRONOUSLY at pin time so it cannot await an import.
+ * plan/PLAN.md §1.4 rules on it: "One copy, in snag.runtime.js; snag.capture.js
+ * imports from it." The spec edit that records the inversion is still owed.
+ *
+ * ── The one thing to know before editing ──
+ *
+ * Every constant below carries `/g`, and `RegExp.prototype.test` on a global
+ * regex is STATEFUL — it advances `lastIndex` and the next call starts from
+ * there. `isSensitiveValue` is called once per candidate attribute per element,
+ * so a naive `EMAIL.test(v)` returns true, then false, then true on identical
+ * input. `hits()` exists for exactly that reason.
+ */
+/**
+ * The key vocabulary, byte-for-byte from 00 §9.
+ *
+ * 04 §4.3: "if the two ever differ, 00 wins." `pin` and `sig` are DELIBERATELY
+ * absent — 00 §9 gives the reason, and adding them is not a fix.
+ */
+const KEY = `pass(?:word|wd)?|pwd|secret|token|api[_-]?key|apikey|auth(?:orization)?|` +
+    `credential|session|sid|cookie|jwt|bearer|otp|mfa|totp|cvv|cvc|ssn|nino|iban|` +
+    `card(?:[_-]?number)?|account[_-]?number|private[_-]?key|signature|` +
+    `client[_-]?secret|refresh[_-]?token|access[_-]?token`;
+/**
+ * key = value, in any of the shapes real payloads use. 00 §9, verbatim.
+ *
+ * THE LEADING BOUNDARY IS A LOOKBEHIND, NOT `\b`. `_` is a word character, so
+ * `\b` finds no boundary between the `B` and the `P` of `DB_PASSWORD` and the
+ * whole snake_case convention was invisible to this rule: `db_password=…`,
+ * `oauth_token=…`, `csrf_token=…`, `app_secret=…` and every SCREAMING_SNAKE
+ * environment variable came back byte-identical, while the bare `password=…`
+ * and the hyphenated `X-API-KEY=…` were redacted correctly. `refresh_token`,
+ * `access_token`, `client_secret`, `api_key`, `private_key`, `card_number` and
+ * `account_number` escaped only because KEY happens to spell those exact
+ * compounds out. `(?<![A-Za-z0-9])` allows a preceding `_`, `-`, `.`, quote,
+ * space or start-of-string and still refuses a letter or digit, so `mypassword`
+ * stays unmatched exactly as `\b` intended.
+ *
+ * Group 1 is the optional quote BEFORE the key; group 2 is the value's opening
+ * quote; group 3 the quoted value body; group 4 the unquoted value. The only
+ * backreference in the whole rule set is this one's `\2`, which is deliberate:
+ * 04 §4.3 makes catastrophic backtracking a hard review criterion, because it
+ * is a denial of service on the reviewer's own main thread.
+ */
+const KV = new RegExp(`(["'\`]?)(?<![A-Za-z0-9])(?:${KEY})[\\w-]*\\b\\1?\\s*[:=]\\s*` +
+    `(?:(["'\`])((?:\\\\.|(?!\\2)[^\\\\])*)\\2|([^\\s,;&}\\])]{3,}))`, "gi");
+/** The auth schemes AUTH_SCHEME knows. Used by the carve-out below. */
+const SCHEME_WORD = /^(?:Bearer|Basic|Digest|Negotiate|Token)$/i;
+/**
+ * Replace the VALUE and keep everything else — the key, the separator, the
+ * whitespace and the quotes. A redaction that ate the key name would destroy
+ * the one part of the pair that is diagnostic rather than secret.
+ *
+ * THE CARVE-OUT, and the leak that forced it. KV's unquoted-value branch stops
+ * at whitespace, so on the single most canonical secret in existence —
+ *
+ *     Authorization: Bearer abcdefgh12345
+ *
+ * — it matched the key `Authorization`, took `Bearer` as the whole value, and
+ * emitted `Authorization: [redacted] abcdefgh12345`. The word was redacted and
+ * THE TOKEN WAS PUBLISHED. AUTH_SCHEME could no longer help, because the scheme
+ * it keys on had just been replaced. Found by running the rules rather than
+ * reading them, which is what 00 §9's own preamble asks for.
+ *
+ * So AUTH_SCHEME runs first (see redactText), and KV then leaves a scheme word
+ * alone *only when the credential after it is already gone*. Both halves are
+ * needed: skipping unconditionally would let `Bearer abc` — too short for
+ * AUTH_SCHEME's 8-char floor — survive untouched, which is worse than the bug.
+ */
+const kvReplace = (m, _q0, q, qv, uv, offset, whole) => {
+    if (!q && SCHEME_WORD.test(uv) && whole.slice(offset + m.length).startsWith(" [redacted]")) {
+        return m;
+    }
+    /**
+     * IDEMPOTENCE. The unquoted-value class `[^\s,;&}\])]{3,}` excludes `]`, so
+     * against an already-redacted `token=[redacted]` it matches `[redacted`,
+     * substitutes `[redacted]`, and strands the original bracket — producing
+     * `token=[redacted]]`. Found end-to-end: `redactUrl` redacts structurally and
+     * then runs the text rules over its own output, so this fired on every
+     * captured URL with a query string. A redaction that corrupts its own marker
+     * reads as a bug in the export rather than as a redaction.
+     */
+    if ((q ? qv : uv).startsWith("[redacted"))
+        return m;
+    const val = q ? `${q}${qv}${q}` : uv;
+    const head = m.slice(0, m.length - val.length);
+    return head + (q ? `${q}[redacted]${q}` : "[redacted]");
+};
+// The shape rules (04 §4.3), verbatim.
+const DATA_URL = /data:[a-z0-9.+-]*\/?[a-z0-9.+-]*;base64,[A-Za-z0-9+/=]{16,}/gi;
+const JWT = /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{0,}/g;
+const KEY_PREFIX = /\b(sk-[A-Za-z0-9]+-[A-Za-z0-9_-]{20,}|sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9]{20,}|(sk|pk|rk)_(live|test)_[A-Za-z0-9]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{16,}|xox[baprs]-[A-Za-z0-9-]{10,}|xapp-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|ya29\.[A-Za-z0-9_-]{20,}|SG\.[A-Za-z0-9_-]{20,}|npm_[A-Za-z0-9]{30,}|dop_v1_[a-f0-9]{40,}|shpat_[a-f0-9]{30,}|sbp_[a-f0-9]{30,}|hf_[A-Za-z0-9]{30,}|nvapi-[A-Za-z0-9_-]{20,})\b/g;
+const AUTH_SCHEME = /\b(Bearer|Basic|Digest|Negotiate|Token)\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+const EMAIL = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z]{2,24})+\b/g;
+const CARD_CAND = /\b(?:\d[ -]?){12,18}\d\b/g;
+const B64 = /\b(?=[A-Za-z0-9+/]*[a-z])(?=[A-Za-z0-9+/]*[A-Z])(?=[A-Za-z0-9+/]*\d)[A-Za-z0-9+/]{40,}={0,2}\b/g;
+const HEX = /\b[0-9a-f]{32,}\b/gi;
+/**
+ * EXTENSIONS. 04 §4.1: redaction "cannot be disabled — only *extended*", which
+ * makes adding a rule the sanctioned move and rewriting a spec-verbatim one the
+ * unsanctioned one. Every constant above is copied from 00 §9 / 04 §4.3 and
+ * stays untouched; each rule below closes a hole an adversarial pass found by
+ * running the module, with the shape that got through named in its comment.
+ */
+/**
+ * Base64URL. B64's class is `[A-Za-z0-9+/]`, verbatim from 00 §9 — so a single
+ * `_` or `-` chops a token into runs under the 40-char floor and B64 never
+ * fires at all. A Cloudflare API token is exactly 40 characters of
+ * `[A-Za-z0-9_-]` with no vendor prefix for KEY_PREFIX to key on, and walked
+ * through untouched.
+ */
+const B64URL = /\b(?=[A-Za-z0-9_-]*[a-z])(?=[A-Za-z0-9_-]*[A-Z])(?=[A-Za-z0-9_-]*\d)[A-Za-z0-9_-]{40,}\b/g;
+/**
+ * `vendor_prefix_PAYLOAD` — the shape KEY_PREFIX cannot enumerate.
+ *
+ * KEY_PREFIX lists vendors one by one, so every provider not on the list ships
+ * whole: Docker Hub PATs, Stripe webhook signing secrets, Supabase service
+ * keys, Netlify and RubyGems tokens. Their payloads are short enough to sit
+ * under B64's 40-char floor, so nothing else catches them either. The two
+ * lookaheads — payload must contain BOTH an uppercase letter and a digit — are
+ * what keep this off ordinary snake_case identifiers.
+ */
+const VENDOR_TOKEN = /\b[a-z][a-z0-9]{1,15}(?:_[a-z0-9]{1,15}){0,2}_(?=[A-Za-z0-9_-]*[A-Z])(?=[A-Za-z0-9_-]*\d)[A-Za-z0-9_-]{24,}\b/g;
+/**
+ * Credentials in a URL authority: `scheme://user:pass@host`.
+ *
+ * EMAIL does not cover it — it requires a dotted TLD after the `@`, so a bare
+ * hostname, an IP or a `+` in the scheme all slip past. `redactUrl` strips
+ * these structurally, but a URL sitting inside free text never reaches that
+ * path, and neither does `isSensitiveValue`.
+ */
+const URL_CRED = /\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:[^\s/@]+@/gi;
+/**
+ * A whole value that IS one unbroken high-entropy token, whatever vendor minted
+ * it (used by `isSensitiveValue` only).
+ *
+ * ANCHORED, deliberately: it must fire on a value that is a credential and
+ * never on prose that merely contains one, or 04 §4.8's negative corpus —
+ * `/orders/2024`, `4 items`, `cardNumber` — starts failing and 03 loses
+ * selectors it should have kept. Mixed case AND a digit AND 24+ characters is
+ * what separates an Azure client secret from `product-card-item-12345678`.
+ */
+const OPAQUE = /^(?=[A-Za-z0-9_~.+/=-]*[a-z])(?=[A-Za-z0-9_~.+/=-]*[A-Z])(?=[A-Za-z0-9_~.+/=-]*\d)[A-Za-z0-9_~.+/=-]{24,}$/;
+/**
+ * Does this string contain a match, without the caller inheriting `lastIndex`?
+ *
+ * `test()` on a `/g` regex mutates the regex. Resetting before each use is the
+ * cheap fix and keeps a single copy of every pattern, which AC C1c cares about:
+ * it greps for a SECOND definition of any of these shapes outside this
+ * directory, so cloning them per call would be the wrong kind of clever.
+ */
+function hits(re, s) {
+    re.lastIndex = 0;
+    const found = re.test(s);
+    re.lastIndex = 0;
+    return found;
+}
+/**
+ * The Luhn checksum. 04 §4.3: "The Luhn gate is not optional and not forkable."
+ *
+ * Three mechanics the spec asserts without specifying, decided here and written
+ * down rather than left as folklore:
+ *   · separators are stripped before the checksum, because CARD_CAND matches
+ *     digits interleaved with single spaces or hyphens and a checksum over
+ *     "4111 1111" is meaningless;
+ *   · the length window is 13–19, the range of real PANs;
+ *   · a candidate that FAILS is left entirely untouched — no retry on a shorter
+ *     window inside the same digit run. A 16-digit order number that happens to
+ *     sit next to a date should survive as itself.
+ */
+function luhn(raw) {
+    const d = raw.replace(/[ -]/g, "");
+    if (d.length < 13 || d.length > 19)
+        return false;
+    let sum = 0;
+    let alt = false;
+    for (let i = d.length - 1; i >= 0; i--) {
+        let n = d.charCodeAt(i) - 48;
+        if (alt) {
+            n *= 2;
+            if (n > 9)
+                n -= 9;
+        }
+        sum += n;
+        alt = !alt;
+    }
+    return sum % 10 === 0;
+}
+/** CARD_CAND ∧ Luhn — the only card test anywhere. */
+function cardHit(s) {
+    CARD_CAND.lastIndex = 0;
+    for (const m of s.matchAll(CARD_CAND))
+        if (luhn(m[0]))
+            return true;
+    return false;
+}
+/**
+ * Free text — messages, serialised data, accessible names (04 §4.2).
+ *
+ * ORDER IS NORMATIVE and the reason is stated in 04 §4.2: "broader patterns run
+ * later so they cannot swallow the input a narrower pattern would have labelled
+ * precisely." A JWT is base64-ish and hex-ish; if B64 ran first every token
+ * would come out as `[redacted:b64:210]` and the reviewer would lose the one
+ * word that told them what leaked. KV runs at position 2, before every shape
+ * rule, and both always run.
+ *
+ * No caps are applied here. §4.6's pre/post caps are PER FIELD and this
+ * signature carries no field identity — the caller applies them, which at v0
+ * means exactly one call site (`CaptureContext.url`).
+ */
+export function redactText(s) {
+    let out = s;
+    out = out.replace(DATA_URL, "data:[redacted]"); // 1
+    // AUTH_SCHEME is MOVED AHEAD OF KV — 04 §4.2 numbers it 5. The letter of the
+    // table leaks (see kvReplace); its stated principle — "broader patterns run
+    // later so they cannot swallow the input a narrower pattern would have
+    // labelled precisely" — is exactly why it has to move, because KV is the
+    // broader of the two. Following the rule rather than the numbering.
+    //
+    // `$1 [redacted]`, NOT the literal "Bearer [redacted]" the table cell shows:
+    // the pattern captures the scheme, so `Basic …` must produce `Basic
+    // [redacted]`. The cell is an example.
+    out = out.replace(AUTH_SCHEME, "$1 [redacted]");
+    out = out.replace(KV, kvReplace); // 2
+    out = out.replace(JWT, "[redacted:jwt]"); // 3
+    out = out.replace(KEY_PREFIX, "[redacted:key]"); // 4
+    out = out.replace(VENDOR_TOKEN, "[redacted:key]"); // 4b — see EXTENSIONS
+    out = out.replace(URL_CRED, "[redacted:url-cred]@"); // 4c
+    out = out.replace(EMAIL, "[redacted:email]"); // 6
+    out = out.replace(CARD_CAND, (m) => (luhn(m) ? "[redacted:card]" : m)); // 7
+    // 8 and 9 carry the MATCHED length, which is the only length computable
+    // without decoding. It is fixture-visible output, so it is stated here.
+    out = out.replace(B64URL, (m) => `[redacted:b64:${m.length}]`); // 8b
+    out = out.replace(B64, (m) => `[redacted:b64:${m.length}]`);
+    out = out.replace(HEX, (m) => `[redacted:hex:${m.length}]`);
+    // 10 (UUID) is gated on `redact.redactUuids`, v0.1, default false.
+    // 11 (server-supplied patterns) is v1. Neither is reachable at v0.
+    return out;
+}
+/** Our own registered query parameters. Values are KEPT — see redactUrl. */
+const OURS = RESERVED_URL_PARAMS.query;
+/** The review-link secret (00 §2.5). It lives in the FRAGMENT and is redacted
+ *  wherever it appears — the one parameter whose value is never displayable. */
+const SECRET_PARAMS = RESERVED_URL_PARAMS.fragment;
+/**
+ * A URL: a structured pass first, then `redactText` over the serialisation
+ * (04 §4.4).
+ *
+ * ALLOW-LIST, NOT DENY-LIST. Parameter *names* survive because the name alone is
+ * diagnostic; values do not. The default is empty and stays empty — 04 §4.4 is
+ * explicit that "the failure mode of a too-loose default (leaking a magic-link
+ * token in every captured URL) is catastrophic". A starter list worth
+ * documenting, never defaulting: page, tab, view, sort, filter, locale, lang.
+ *
+ * Our own parameters keep their values, because a report about the wrong
+ * permalink is unreadable without the permalink — except `snag_k`, which is the
+ * review-link secret and is always redacted.
+ *
+ * URL PATHS ARE NOT FULLY REDACTED (04 §6 item 4). Path segments get no
+ * structural treatment; they are covered only by the trailing `redactText`.
+ * That is deliberate and documented, not an oversight.
+ */
+export function redactUrl(raw, allow = []) {
+    let u;
+    try {
+        // `globalThis.location`, reached through a cast, rather than the bare
+        // `location` global. The runtime guard was always right; the TYPE was
+        // browser-only, and 07 §2.6.2 requires this module to be usable
+        // server-side ("publish that module as an isomorphic export usable
+        // server-side, not only inside widget-core"). Under Node's lib the bare
+        // global does not exist to name, so the file did not compile there at all.
+        const here = globalThis.location?.href;
+        u = new URL(raw, here);
+    }
+    catch {
+        // Not parseable as a URL — it still goes through the text rules rather than
+        // through untouched. §4.7: nothing reaches a surface un-redacted.
+        return redactText(raw);
+    }
+    u.username = "";
+    u.password = "";
+    for (const k of [...u.searchParams.keys()]) {
+        // From the registry, not typed: `snag_k` is a registered name (00 §2.5) and
+        // a rename would have left this literal behind — so the ONE parameter that
+        // must always be redacted would quietly stop being.
+        if (SECRET_PARAMS.includes(k)) {
+            u.searchParams.set(k, "[redacted]");
+            continue;
+        }
+        if (OURS.includes(k))
+            continue;
+        if (!allow.includes(k)) {
+            u.searchParams.set(k, "[redacted]");
+            continue;
+        }
+        // AN ALLOWED PARAMETER IS NOT A LICENCE. The trailing text pass runs over
+        // the SERIALISED url, where the value is still percent-encoded — so
+        // `?filter=password%3DSuperSecret123` defeated KV outright, because `%3D`
+        // is not `=`. `searchParams.get` decodes, so checking here is the only
+        // place the rules see what the value actually says. If they recognise
+        // anything in it, the whole value goes: an operator allow-listing a
+        // parameter is saying its values are ordinarily safe, not promising it.
+        const decoded = u.searchParams.get(k) ?? "";
+        if (redactText(decoded) !== decoded)
+            u.searchParams.set(k, "[redacted]");
+    }
+    // The fragment is redacted WHOLE, not per key: it is where the review-link
+    // secret lives, and a per-key pass would leave its shape visible.
+    if (u.hash && u.hash.length > 1)
+        u.hash = allow.includes("#") ? u.hash : "#[redacted]";
+    // `URLSearchParams` serialises form-urlencoded, which escapes [ and ] — so
+    // `set(k, "[redacted]")` comes back out as `token=%5Bredacted%5D` and 04's own
+    // illustration (`?utm_source=[redacted]&token=[redacted]`) is unreachable.
+    // Un-escaping just our own marker is narrower than hand-building the query
+    // string and does not touch any value the host page owns.
+    return redactText(u.toString().replace(/%5Bredacted%5D/gi, "[redacted]"));
+}
+/**
+ * Should this attribute value stay out of a generated selector? (04 §4.8)
+ *
+ * THE SINGLE NORMATIVE DEFINITION — 03 imports this symbol rather than carrying
+ * its own copy, and AC C1c greps for a second one. The 120-char clause is 04's
+ * value; 03's 100 is deleted. The hex threshold is 32; 03's 24 is deleted.
+ *
+ * Composed from exactly seven shapes plus the length clause — deliberately NOT
+ * from KV, AUTH_SCHEME or UUID, which describe text that contains a secret
+ * rather than a value that IS one.
+ *
+ * 04 §4.8 is careful about what this does not do: "This does not make selectors
+ * private" — `a[href="/users/jane.doe/invoices"]` still passes the guard. It
+ * keeps credentials out of selectors, not personal data.
+ */
+/**
+ * The key test for OBJECT keys — 04 §4.5's "key-first" step for
+ * `Breadcrumb.data` and (v1) `custom`. Same vocabulary, same boundary
+ * semantics as KV: the lookbehind is what lets `DB_PASSWORD` and the
+ * `[\w-]*` tail is what lets `refreshToken`/`token_count` match, exactly as
+ * the string form `db_password=…` would. One list, two syntaxes — a separate
+ * key list here is the fork 00 §14.2 forbids.
+ */
+const KEY_NAME = new RegExp(`(?<![A-Za-z0-9])(?:${KEY})[\\w-]*$`, "i");
+export function isSensitiveKey(k) {
+    return KEY_NAME.test(k);
+}
+export function isSensitiveValue(v) {
+    if (v.length > 120)
+        return true;
+    return (hits(EMAIL, v) ||
+        hits(JWT, v) ||
+        hits(KEY_PREFIX, v) ||
+        hits(HEX, v) ||
+        hits(B64, v) ||
+        hits(DATA_URL, v) ||
+        // The extensions. This predicate is the ENTIRE defence for AnchorRecord
+        // .label — 04 §4.5 gives that field redaction "none" precisely because this
+        // gate stands in front of it — so a shape that gets past here goes verbatim
+        // into storage, the dock, the Markdown export and any issue built from it.
+        hits(B64URL, v) ||
+        hits(VENDOR_TOKEN, v) ||
+        hits(URL_CRED, v) ||
+        OPAQUE.test(v) ||
+        cardHit(v));
+}