@tangle-network/agent-runtime 0.189.0 → 0.191.0

package/dist/redact-D-u-rrcn.js

@@ -1,82 +0,0 @@
-//#region src/redact.ts
-const redactedMarker = "[redacted]";
-/** Secret-bearing key names: when an object key matches, its value is fully
-*  replaced regardless of the value's own content. Lowercased compare. */
-const secretKeyPattern = /(api[-_]?key|secret|token|password|passwd|authorization|auth|private[-_]?key|credential|access[-_]?key|client[-_]?secret|session[-_]?(id|token)|cookie|bearer)/i;
-/** In-value secret/PII patterns scrubbed from any string, regardless of key. */
-const valuePatterns = [
-	/\bBearer\s+[A-Za-z0-9._\-+/=]{8,}/gi,
-	/\b(?:sk|pk|rk|ak)[-_][A-Za-z0-9_-]{12,}/g,
-	/\bgh[pousr]_[A-Za-z0-9]{20,}/g,
-	/\bAKIA[0-9A-Z]{16}\b/g,
-	/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
-	/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g
-];
-/** Secret assignments embedded inside an otherwise opaque string, including
-* serialized JSON and log-style `key=value` text. */
-const secretAssignmentPattern = /((?:"|')?(?:api[-_]?key|secret|token|password|passwd|authorization|auth|private[-_]?key|credential|access[-_]?key|client[-_]?secret|session[-_]?(?:id|token)|cookie|bearer)(?:"|')?\s*[:=]\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;}]+)/gi;
-/** Scrub a single string of in-value secret/PII patterns. */
-function scrubString(input) {
-	let out = input;
-	for (const pattern of valuePatterns) out = out.replace(pattern, redactedMarker);
-	return out.replace(secretAssignmentPattern, `$1${redactedMarker}`);
-}
-/**
-* The built-in redactor. Walks objects and arrays; replaces values under
-* secret-bearing keys wholesale; scrubs in-value patterns from every string.
-* Cycle-safe (a seen-set short-circuits self-referential payloads to
-* `'[circular]'`), depth-bounded, and total — never throws on customer input.
-*/
-function defaultRedactor(value) {
-	return walk(value, /* @__PURE__ */ new WeakSet(), 0);
-}
-const maxDepth = 32;
-function walk(value, seen, depth) {
-	if (depth > maxDepth) return "[truncated]";
-	if (typeof value === "string") return scrubString(value);
-	if (value === null || typeof value !== "object") return value;
-	if (seen.has(value)) return "[circular]";
-	seen.add(value);
-	if (Array.isArray(value)) return value.map((item) => walk(item, seen, depth + 1));
-	const out = {};
-	for (const [key, v] of Object.entries(value)) {
-		if (secretKeyPattern.test(key)) {
-			out[key] = redactedMarker;
-			continue;
-		}
-		out[key] = walk(v, seen, depth + 1);
-	}
-	return out;
-}
-/** Stable identity input for saved work that depends on built-in redaction behavior. */
-function defaultRedactorIdentityMaterial() {
-	const patternIdentity = (pattern) => ({
-		source: pattern.source,
-		flags: pattern.flags
-	});
-	return {
-		marker: redactedMarker,
-		secretKeyPattern: patternIdentity(secretKeyPattern),
-		valuePatterns: valuePatterns.map(patternIdentity),
-		secretAssignmentPattern: patternIdentity(secretAssignmentPattern),
-		maxDepth,
-		scrubString: Function.prototype.toString.call(scrubString),
-		walk: Function.prototype.toString.call(walk),
-		defaultRedactor: Function.prototype.toString.call(defaultRedactor)
-	};
-}
-/**
-* Resolve the redactor a client uses. A caller-supplied hook handles
-* domain-specific values first, then the built-in scrubber still removes
-* common credentials and email addresses. Returning `false` is the explicit
-* opt-out for already-reviewed public values.
-*/
-function resolveRedactor(redact) {
-	if (redact === false) return (value) => value;
-	if (!redact) return defaultRedactor;
-	return (value) => defaultRedactor(redact(value));
-}
-//#endregion
-export { defaultRedactorIdentityMaterial as n, resolveRedactor as r, defaultRedactor as t };
-
-//# sourceMappingURL=redact-D-u-rrcn.js.map

package/dist/redact-D-u-rrcn.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"redact-D-u-rrcn.js","names":[],"sources":["../src/redact.ts"],"sourcesContent":["/**\n *\n * Redaction for values that may leave the Runtime process. The default scrubs\n * common leak classes (API keys, bearer tokens, emails, private keys) from\n * strings and walks nested objects and arrays. A customer with domain-specific\n * PII supplies their own `redact` hook.\n *\n * This is intentionally narrower than `src/sanitize.ts` (which redacts the\n * runtime's *event envelope* field-by-field): here the value is opaque\n * customer payload, so the scrub is value-shaped, not schema-shaped.\n *\n * @experimental\n */\n\n/** A redactor maps an arbitrary trace value to a safe-to-export value. Pure;\n *  must not throw on cyclic input (the default tolerates cycles). */\nexport type Redactor = (value: unknown) => unknown\n\nconst redactedMarker = '[redacted]'\n\n/** Secret-bearing key names: when an object key matches, its value is fully\n *  replaced regardless of the value's own content. Lowercased compare. */\nconst secretKeyPattern =\n  /(api[-_]?key|secret|token|password|passwd|authorization|auth|private[-_]?key|credential|access[-_]?key|client[-_]?secret|session[-_]?(id|token)|cookie|bearer)/i\n\n/** In-value secret/PII patterns scrubbed from any string, regardless of key. */\nconst valuePatterns: ReadonlyArray<RegExp> = [\n  // Bearer tokens.\n  /\\bBearer\\s+[A-Za-z0-9._\\-+/=]{8,}/gi,\n  // Provider-style API keys (sk-..., sk-tan-..., pk_live_..., ghp_...).\n  /\\b(?:sk|pk|rk|ak)[-_][A-Za-z0-9_-]{12,}/g,\n  /\\bgh[pousr]_[A-Za-z0-9]{20,}/g,\n  // AWS access key ids.\n  /\\bAKIA[0-9A-Z]{16}\\b/g,\n  // PEM private-key blocks.\n  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,\n  // Email addresses.\n  /\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}\\b/g,\n]\n\n/** Secret assignments embedded inside an otherwise opaque string, including\n * serialized JSON and log-style `key=value` text. */\nconst secretAssignmentPattern =\n  /((?:\"|')?(?:api[-_]?key|secret|token|password|passwd|authorization|auth|private[-_]?key|credential|access[-_]?key|client[-_]?secret|session[-_]?(?:id|token)|cookie|bearer)(?:\"|')?\\s*[:=]\\s*)(?:\"(?:\\\\.|[^\"\\\\])*\"|'(?:\\\\.|[^'\\\\])*'|[^\\s,;}]+)/gi\n\n/** Scrub a single string of in-value secret/PII patterns. */\nfunction scrubString(input: string): string {\n  let out = input\n  for (const pattern of valuePatterns) {\n    out = out.replace(pattern, redactedMarker)\n  }\n  return out.replace(secretAssignmentPattern, `$1${redactedMarker}`)\n}\n\n/**\n * The built-in redactor. Walks objects and arrays; replaces values under\n * secret-bearing keys wholesale; scrubs in-value patterns from every string.\n * Cycle-safe (a seen-set short-circuits self-referential payloads to\n * `'[circular]'`), depth-bounded, and total — never throws on customer input.\n */\nexport function defaultRedactor(value: unknown): unknown {\n  return walk(value, new WeakSet(), 0)\n}\n\nconst maxDepth = 32\n\nfunction walk(value: unknown, seen: WeakSet<object>, depth: number): unknown {\n  if (depth > maxDepth) return '[truncated]'\n  if (typeof value === 'string') return scrubString(value)\n  if (value === null || typeof value !== 'object') return value\n  if (seen.has(value)) return '[circular]'\n  seen.add(value)\n\n  if (Array.isArray(value)) {\n    return value.map((item) => walk(item, seen, depth + 1))\n  }\n\n  const out: Record<string, unknown> = {}\n  for (const [key, v] of Object.entries(value as Record<string, unknown>)) {\n    if (secretKeyPattern.test(key)) {\n      out[key] = redactedMarker\n      continue\n    }\n    out[key] = walk(v, seen, depth + 1)\n  }\n  return out\n}\n\n/** Stable identity input for saved work that depends on built-in redaction behavior. */\nexport function defaultRedactorIdentityMaterial(): unknown {\n  const patternIdentity = (pattern: RegExp) => ({\n    source: pattern.source,\n    flags: pattern.flags,\n  })\n  return {\n    marker: redactedMarker,\n    secretKeyPattern: patternIdentity(secretKeyPattern),\n    valuePatterns: valuePatterns.map(patternIdentity),\n    secretAssignmentPattern: patternIdentity(secretAssignmentPattern),\n    maxDepth,\n    scrubString: Function.prototype.toString.call(scrubString),\n    walk: Function.prototype.toString.call(walk),\n    defaultRedactor: Function.prototype.toString.call(defaultRedactor),\n  }\n}\n\n/**\n * Resolve the redactor a client uses. A caller-supplied hook handles\n * domain-specific values first, then the built-in scrubber still removes\n * common credentials and email addresses. Returning `false` is the explicit\n * opt-out for already-reviewed public values.\n */\nexport function resolveRedactor(redact: Redactor | false | undefined): Redactor {\n  if (redact === false) return (value) => value\n  if (!redact) return defaultRedactor\n  return (value) => defaultRedactor(redact(value))\n}\n"],"mappings":";AAkBA,MAAM,iBAAiB;;;AAIvB,MAAM,mBACJ;;AAGF,MAAM,gBAAuC;CAE3C;CAEA;CACA;CAEA;CAEA;CAEA;AACF;;;AAIA,MAAM,0BACJ;;AAGF,SAAS,YAAY,OAAuB;CAC1C,IAAI,MAAM;CACV,KAAK,MAAM,WAAW,eACpB,MAAM,IAAI,QAAQ,SAAS,cAAc;CAE3C,OAAO,IAAI,QAAQ,yBAAyB,KAAK,gBAAgB;AACnE;;;;;;;AAQA,SAAgB,gBAAgB,OAAyB;CACvD,OAAO,KAAK,uBAAO,IAAI,QAAQ,GAAG,CAAC;AACrC;AAEA,MAAM,WAAW;AAEjB,SAAS,KAAK,OAAgB,MAAuB,OAAwB;CAC3E,IAAI,QAAQ,UAAU,OAAO;CAC7B,IAAI,OAAO,UAAU,UAAU,OAAO,YAAY,KAAK;CACvD,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,IAAI,KAAK,IAAI,KAAK,GAAG,OAAO;CAC5B,KAAK,IAAI,KAAK;CAEd,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,SAAS,KAAK,MAAM,MAAM,QAAQ,CAAC,CAAC;CAGxD,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,KAAK,MAAM,OAAO,QAAQ,KAAgC,GAAG;EACvE,IAAI,iBAAiB,KAAK,GAAG,GAAG;GAC9B,IAAI,OAAO;GACX;EACF;EACA,IAAI,OAAO,KAAK,GAAG,MAAM,QAAQ,CAAC;CACpC;CACA,OAAO;AACT;;AAGA,SAAgB,kCAA2C;CACzD,MAAM,mBAAmB,aAAqB;EAC5C,QAAQ,QAAQ;EAChB,OAAO,QAAQ;CACjB;CACA,OAAO;EACL,QAAQ;EACR,kBAAkB,gBAAgB,gBAAgB;EAClD,eAAe,cAAc,IAAI,eAAe;EAChD,yBAAyB,gBAAgB,uBAAuB;EAChE;EACA,aAAa,SAAS,UAAU,SAAS,KAAK,WAAW;EACzD,MAAM,SAAS,UAAU,SAAS,KAAK,IAAI;EAC3C,iBAAiB,SAAS,UAAU,SAAS,KAAK,eAAe;CACnE;AACF;;;;;;;AAQA,SAAgB,gBAAgB,QAAgD;CAC9E,IAAI,WAAW,OAAO,QAAQ,UAAU;CACxC,IAAI,CAAC,QAAQ,OAAO;CACpB,QAAQ,UAAU,gBAAgB,OAAO,KAAK,CAAC;AACjD"}