@vibesdotdev/logging 0.0.2 → 1.0.0-rc.5

package/dist/core/otlp-headers.js

@@ -0,0 +1,64 @@
+/**
+ * OTLP exporter headers are a credential: they resolve only through the
+ * runtime's credential capability from a declared reference, never from an
+ * environment variable, a stored config value or the SDK's ambient fallback.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+/**
+ * An HTTP field name: an RFC 9110 `token` (`!#$%&'*+-.^_`|~`, digits and
+ * letters), so a name a transport would refuse never reaches it.
+ */
+export const OtlpHeaderNameSchema = z.string().regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/);
+/**
+ * An HTTP field value as an exporter sends it: visible ASCII (0x21-0x7E), with
+ * spaces and tabs allowed only inside. No CR, LF, NUL, other control character
+ * or non-ASCII character (a smart quote, say), which `fetch` refuses by echoing
+ * the whole value in its error.
+ */
+export const OtlpHeaderValueSchema = z.string().regex(/^[\x21-\x7E](?:[\x21-\x7E \t]*[\x21-\x7E])?$/);
+/** The headers an exporter sends: token names and visible-ASCII values. */
+export const OtlpExporterHeadersSchema = z.record(OtlpHeaderNameSchema, OtlpHeaderValueSchema);
+function malformedPair(credentialKey, index, pairs, part) {
+    return new CapabilityError(`The OTLP header credential '${credentialKey}' has a malformed ${part === 'pair' ? 'pair' : `header ${part}`} (pair ${index + 1} of ${pairs}).`, 'INVALID_INPUT', {
+        reason: 'otel-headers-invalid', retryable: false, details: { key: credentialKey, pair: index + 1, pairs, part }
+    });
+}
+/**
+ * Parse the resolved header credential (`key=value` pairs, comma separated).
+ * Every name must be an RFC 9110 token and every value visible ASCII (spaces
+ * and tabs only inside); a malformed pair refuses `INVALID_INPUT
+ * otel-headers-invalid` with its position and which part is malformed only:
+ * the credential value never reaches an error, a log or a detail.
+ */
+export function parseOtelHeaders(rawHeaders, credentialKey) {
+    const headers = {};
+    const pairs = rawHeaders.split(',');
+    for (const [index, pair] of pairs.entries()) {
+        const separator = pair.indexOf('=');
+        if (separator <= 0)
+            throw malformedPair(credentialKey, index, pairs.length, 'pair');
+        const name = OtlpHeaderNameSchema.safeParse(pair.slice(0, separator).trim());
+        if (!name.success)
+            throw malformedPair(credentialKey, index, pairs.length, 'name');
+        const value = OtlpHeaderValueSchema.safeParse(pair.slice(separator + 1).trim());
+        if (!value.success)
+            throw malformedPair(credentialKey, index, pairs.length, 'value');
+        headers[name.data] = value.data;
+    }
+    return headers;
+}
+/** The exporter headers from the declared credential: resolved, or confirmed not set. Other failures throw typed. */
+export async function resolveOtelHeaders(runtime, reference) {
+    const resolution = await runtime.resolveCredential(reference);
+    if (resolution.ok) {
+        const headers = parseOtelHeaders(resolution.value, reference.key);
+        return { headers, source: { key: reference.key, state: 'resolved', count: Object.keys(headers).length } };
+    }
+    // `NOT_FOUND credential-not-set` is the one confirmed absence; every other failure is thrown typed.
+    if (resolution.error.code === 'NOT_FOUND' && resolution.error.reason === 'credential-not-set') {
+        return { headers: undefined, source: { key: reference.key, state: 'not-set', count: 0 } };
+    }
+    throw resolution.error;
+}
+//# sourceMappingURL=otlp-headers.js.map

package/dist/core/otlp-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otlp-headers.js","sourceRoot":"","sources":["../../src/core/otlp-headers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AAEzE,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAU5B;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;AACtF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;AACtG,2EAA2E;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAAC;AAO/F,SAAS,aAAa,CAAC,aAAqB,EAAE,KAAa,EAAE,KAAa,EAAE,IAAwB;IACnG,OAAO,IAAI,eAAe,CAAC,+BAA+B,aAAa,qBAAqB,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,UAAU,KAAK,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,eAAe,EAAE;QAC5L,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;KAC/G,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,aAAqB;IACzE,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM,aAAa,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,aAAa,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,aAAa,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,qHAAqH;AACrH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,OAAgD,EAChD,SAA8B;IAE9B,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC3G,CAAC;IACD,oGAAoG;IACpG,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QAC/F,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,UAAU,CAAC,KAAK,CAAC;AACxB,CAAC"}

package/dist/core/otlp-partial-success.d.ts

@@ -0,0 +1,48 @@
+/**
+ * An OTLP collector may accept an export and still reject part of it: the
+ * response is a success carrying `partialSuccess` with the count of rejected
+ * records (`rejectedLogRecords`, `rejectedSpans` or `rejectedDataPoints`) and
+ * an optional `errorMessage`. The OpenTelemetry SDK hands that to its diag
+ * logger, which is a no-op by default, so a rejection would be silent. A
+ * partial rejection is a collector failure: Logging reads it with this schema
+ * and reports the count, once, through the runtime.
+ */
+import * as z from 'zod/v4';
+/** The OTLP signals and the field each one's partial success counts its rejected records in. */
+export declare const OTLP_REJECTED_FIELDS: {
+    readonly logs: "rejectedLogRecords";
+    readonly traces: "rejectedSpans";
+    readonly metrics: "rejectedDataPoints";
+};
+/** An OTLP signal. */
+export type OtlpSignal = keyof typeof OTLP_REJECTED_FIELDS;
+/** The most of a collector's success body read for its partial success; past it the body is not read. */
+export declare const OTLP_RESPONSE_BODY_LIMIT_BYTES: number;
+/** The most of a collector's `errorMessage` a report carries, after scrubbing. */
+export declare const OTLP_ERROR_MESSAGE_LIMIT = 512;
+/** An OTLP export response: any object, its `partialSuccess` read when present (absent fields mean zero and no message). */
+export declare const OtlpExportResponseSchema: z.ZodObject<{
+    partialSuccess: z.ZodOptional<z.ZodObject<{
+        rejectedLogRecords: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodPipe<z.ZodString, z.ZodTransform<number, string>>]>>;
+        rejectedSpans: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodPipe<z.ZodString, z.ZodTransform<number, string>>]>>;
+        rejectedDataPoints: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodPipe<z.ZodString, z.ZodTransform<number, string>>]>>;
+        errorMessage: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/** A parsed OTLP export response. */
+export type OtlpExportResponse = z.infer<typeof OtlpExportResponseSchema>;
+/** What a partial rejection reports: the count and, scrubbed and bounded, the collector's message. Never a request credential. */
+export interface OtlpPartialRejection {
+    readonly signal: OtlpSignal;
+    readonly rejected: number;
+    readonly errorMessage?: string;
+}
+/**
+ * The rejection to report for one parsed export response, or `null` when the
+ * collector rejected nothing. The collector's `errorMessage` is text a peer
+ * controls (it can echo the request), so it passes the endpoint text schema
+ * with the request's header values (`secrets`) and is cut to
+ * {@link OTLP_ERROR_MESSAGE_LIMIT} characters after scrubbing.
+ */
+export declare function readOtlpPartialRejection(signal: OtlpSignal, response: OtlpExportResponse, endpoint: string, secrets: readonly string[]): OtlpPartialRejection | null;
+//# sourceMappingURL=otlp-partial-success.d.ts.map

package/dist/core/otlp-partial-success.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otlp-partial-success.d.ts","sourceRoot":"","sources":["../../src/core/otlp-partial-success.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,gGAAgG;AAChG,eAAO,MAAM,oBAAoB;;;;CAIvB,CAAC;AACX,sBAAsB;AACtB,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,oBAAoB,CAAC;AAE3D,yGAAyG;AACzG,eAAO,MAAM,8BAA8B,QAAY,CAAC;AACxD,kFAAkF;AAClF,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAW5C,4HAA4H;AAC5H,eAAO,MAAM,wBAAwB;;;;;;;iBAOnC,CAAC;AAEH,qCAAqC;AACrC,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,kIAAkI;AAClI,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,oBAAoB,GAAG,IAAI,CAMpK"}

package/dist/core/otlp-partial-success.js

@@ -0,0 +1,55 @@
+/**
+ * An OTLP collector may accept an export and still reject part of it: the
+ * response is a success carrying `partialSuccess` with the count of rejected
+ * records (`rejectedLogRecords`, `rejectedSpans` or `rejectedDataPoints`) and
+ * an optional `errorMessage`. The OpenTelemetry SDK hands that to its diag
+ * logger, which is a no-op by default, so a rejection would be silent. A
+ * partial rejection is a collector failure: Logging reads it with this schema
+ * and reports the count, once, through the runtime.
+ */
+import * as z from 'zod/v4';
+import { createEndpointTextSchema } from "./endpoint.js";
+/** The OTLP signals and the field each one's partial success counts its rejected records in. */
+export const OTLP_REJECTED_FIELDS = {
+    logs: 'rejectedLogRecords',
+    traces: 'rejectedSpans',
+    metrics: 'rejectedDataPoints'
+};
+/** The most of a collector's success body read for its partial success; past it the body is not read. */
+export const OTLP_RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
+/** The most of a collector's `errorMessage` a report carries, after scrubbing. */
+export const OTLP_ERROR_MESSAGE_LIMIT = 512;
+/**
+ * A rejected-record count: OTLP/JSON writes an int64 as a JSON number or as a
+ * decimal string, the SDK's protobuf reader as a number.
+ */
+const RejectedCountSchema = z.union([
+    z.number().int().nonnegative(),
+    z.string().regex(/^\d{1,15}$/).transform(Number)
+]);
+/** An OTLP export response: any object, its `partialSuccess` read when present (absent fields mean zero and no message). */
+export const OtlpExportResponseSchema = z.object({
+    partialSuccess: z.object({
+        rejectedLogRecords: RejectedCountSchema.optional(),
+        rejectedSpans: RejectedCountSchema.optional(),
+        rejectedDataPoints: RejectedCountSchema.optional(),
+        errorMessage: z.string().optional()
+    }).optional()
+});
+/**
+ * The rejection to report for one parsed export response, or `null` when the
+ * collector rejected nothing. The collector's `errorMessage` is text a peer
+ * controls (it can echo the request), so it passes the endpoint text schema
+ * with the request's header values (`secrets`) and is cut to
+ * {@link OTLP_ERROR_MESSAGE_LIMIT} characters after scrubbing.
+ */
+export function readOtlpPartialRejection(signal, response, endpoint, secrets) {
+    const partial = response.partialSuccess;
+    const rejected = partial?.[OTLP_REJECTED_FIELDS[signal]] ?? 0;
+    if (partial === undefined || rejected === 0)
+        return null;
+    if (!partial.errorMessage)
+        return { signal, rejected };
+    return { signal, rejected, errorMessage: createEndpointTextSchema(endpoint, secrets).parse(partial.errorMessage).slice(0, OTLP_ERROR_MESSAGE_LIMIT) };
+}
+//# sourceMappingURL=otlp-partial-success.js.map

package/dist/core/otlp-partial-success.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otlp-partial-success.js","sourceRoot":"","sources":["../../src/core/otlp-partial-success.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEzD,gGAAgG;AAChG,MAAM,CAAC,MAAM,oBAAoB,GAAG;IACnC,IAAI,EAAE,oBAAoB;IAC1B,MAAM,EAAE,eAAe;IACvB,OAAO,EAAE,oBAAoB;CACpB,CAAC;AAIX,yGAAyG;AACzG,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,IAAI,CAAC;AACxD,kFAAkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAE5C;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC;IACnC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC9B,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;CAChD,CAAC,CAAC;AAEH,4HAA4H;AAC5H,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,kBAAkB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;QAClD,aAAa,EAAE,mBAAmB,CAAC,QAAQ,EAAE;QAC7C,kBAAkB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;QAClD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CAAC,QAAQ,EAAE;CACb,CAAC,CAAC;AAYH;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAkB,EAAE,QAA4B,EAAE,QAAgB,EAAE,OAA0B;IACtI,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,YAAY;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACvD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,EAAE,CAAC;AACvJ,CAAC"}

package/dist/core/outcome.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Failure outcomes as values.
+ *
+ * A logging backend must never break the caller that logged, and its failure
+ * must stay visible. These helpers turn a throw or a rejection into a value
+ * that carries its cause, so the owner decides what the failure means
+ * (report it, retain it for close, or rethrow it) with nothing able to drop it.
+ */
+/** What an operation produced, or the failure it raised. */
+export type Outcome<T> = {
+    readonly failed: false;
+    readonly value: T;
+} | {
+    readonly failed: true;
+    readonly cause: unknown;
+};
+/** Run a synchronous operation; a throw becomes a failed outcome carrying its cause. */
+export declare function attempt<T>(run: () => T): Outcome<T>;
+/** Observe an asynchronous operation; a rejection becomes a failed outcome carrying its cause. */
+export declare function settle<T>(operation: PromiseLike<T>): Promise<Outcome<T>>;
+//# sourceMappingURL=outcome.d.ts.map

package/dist/core/outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.d.ts","sourceRoot":"","sources":["../../src/core/outcome.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,4DAA4D;AAC5D,MAAM,MAAM,OAAO,CAAC,CAAC,IAClB;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC7C;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtD,wFAAwF;AACxF,wBAAgB,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAMnD;AAED,kGAAkG;AAClG,wBAAgB,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAOxE"}

package/dist/core/outcome.js

@@ -0,0 +1,24 @@
+/**
+ * Failure outcomes as values.
+ *
+ * A logging backend must never break the caller that logged, and its failure
+ * must stay visible. These helpers turn a throw or a rejection into a value
+ * that carries its cause, so the owner decides what the failure means
+ * (report it, retain it for close, or rethrow it) with nothing able to drop it.
+ */
+/** Run a synchronous operation; a throw becomes a failed outcome carrying its cause. */
+export function attempt(run) {
+    try {
+        return { failed: false, value: run() };
+    }
+    catch (cause) {
+        return { failed: true, cause };
+    }
+}
+/** Observe an asynchronous operation; a rejection becomes a failed outcome carrying its cause. */
+export function settle(operation) {
+    // `Promise.resolve` reads a real promise's `constructor` synchronously, which a hostile
+    // getter can throw from; resolving inside the executor turns that into a rejection.
+    return new Promise((resolve) => resolve(operation)).then((value) => ({ failed: false, value }), (cause) => ({ failed: true, cause }));
+}
+//# sourceMappingURL=outcome.js.map

package/dist/core/outcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.js","sourceRoot":"","sources":["../../src/core/outcome.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,wFAAwF;AACxF,MAAM,UAAU,OAAO,CAAI,GAAY;IACtC,IAAI,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;AACF,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,MAAM,CAAI,SAAyB;IAClD,wFAAwF;IACxF,oFAAoF;IACpF,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAC1D,CAAC,KAAK,EAAc,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EACjD,CAAC,KAAK,EAAc,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAChD,CAAC;AACH,CAAC"}

package/dist/core/output-resources.d.ts

@@ -0,0 +1,15 @@
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+/** Selected sinks and outputs that own asynchronous cleanup. */
+interface LoggingResource {
+    close(): Promise<void>;
+}
+export declare function trackLoggingResource(runtime: RuntimeRef, output: LoggingResource): void;
+export declare function untrackLoggingResource(runtime: RuntimeRef, output: LoggingResource): void;
+/** A Logging plugin registration began on `runtime`'s Root. */
+export declare function beginLoggingRegistration(runtime: RuntimeRef): void;
+/** A Logging plugin registration finalized; true when none remains on the Root, so the Root's Logging ends. */
+export declare function endLoggingRegistration(runtime: RuntimeRef): boolean;
+/** Logging's last finalization on a Root: close emission (when finalizing), then the Root's resources. */
+export declare function disposeLoggingResources(runtime: RuntimeRef): Promise<void>;
+export {};
+//# sourceMappingURL=output-resources.d.ts.map

package/dist/core/output-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-resources.d.ts","sourceRoot":"","sources":["../../src/core/output-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAItD,gEAAgE;AAChE,UAAU,eAAe;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAUD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAOvF;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAEzF;AAUD,+DAA+D;AAC/D,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAElE;AAED,+GAA+G;AAC/G,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAInE;AAED,0GAA0G;AAC1G,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAShF"}

package/dist/core/output-resources.js

@@ -0,0 +1,51 @@
+import { closeLoggingEmission } from "./emission-window.js";
+import { loggingRootOf } from "./root-identity.js";
+/**
+ * Resources per Root (`loggingRootOf(runtime)`): a sink or output resolved
+ * through a reload generation or a plugin view is the Root's, and closes with
+ * Logging's last finalization on the Root; a generation's retirement never
+ * closes it.
+ */
+const resources = new WeakMap();
+export function trackLoggingResource(runtime, output) {
+    let outputs = resources.get(loggingRootOf(runtime));
+    if (!outputs) {
+        outputs = new Set();
+        resources.set(loggingRootOf(runtime), outputs);
+    }
+    outputs.add(output);
+}
+export function untrackLoggingResource(runtime, output) {
+    resources.get(loggingRootOf(runtime))?.delete(output);
+}
+/**
+ * Live Logging plugin registrations per Root. A reload generation that
+ * replaces Logging registers a new epoch before the previous one retires, so
+ * the count tells a handover (another registration still serves the Root)
+ * from Logging's last finalization on that Root.
+ */
+const registrations = new WeakMap();
+/** A Logging plugin registration began on `runtime`'s Root. */
+export function beginLoggingRegistration(runtime) {
+    registrations.set(loggingRootOf(runtime), (registrations.get(loggingRootOf(runtime)) ?? 0) + 1);
+}
+/** A Logging plugin registration finalized; true when none remains on the Root, so the Root's Logging ends. */
+export function endLoggingRegistration(runtime) {
+    const remaining = Math.max(0, (registrations.get(loggingRootOf(runtime)) ?? 0) - 1);
+    registrations.set(loggingRootOf(runtime), remaining);
+    return remaining === 0;
+}
+/** Logging's last finalization on a Root: close emission (when finalizing), then the Root's resources. */
+export async function disposeLoggingResources(runtime) {
+    // Logging finalizes after every plugin that depends on it: from here on its loggers refuse.
+    closeLoggingEmission(runtime);
+    const outputs = resources.get(loggingRootOf(runtime));
+    if (!outputs)
+        return;
+    const closed = await Promise.allSettled([...outputs].map(output => output.close()));
+    const failures = closed.filter(result => result.status === 'rejected').map(result => result.reason);
+    if (failures.length > 0)
+        throw new AggregateError(failures, 'Logging output cleanup failed.');
+    resources.delete(loggingRootOf(runtime));
+}
+//# sourceMappingURL=output-resources.js.map

package/dist/core/output-resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-resources.js","sourceRoot":"","sources":["../../src/core/output-resources.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAOnD;;;;;GAKG;AACH,MAAM,SAAS,GAAG,IAAI,OAAO,EAA6C,CAAC;AAE3E,MAAM,UAAU,oBAAoB,CAAC,OAAmB,EAAE,MAAuB;IAChF,IAAI,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;QACpB,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAmB,EAAE,MAAuB;IAClF,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,aAAa,GAAG,IAAI,OAAO,EAA+B,CAAC;AAEjE,+DAA+D;AAC/D,MAAM,UAAU,wBAAwB,CAAC,OAAmB;IAC3D,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,sBAAsB,CAAC,OAAmB;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;IACrD,OAAO,SAAS,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAmB;IAChE,4FAA4F;IAC5F,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAC;IAC9F,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1C,CAAC"}

package/dist/core/parsing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsing.d.ts","sourceRoot":"","sources":["../../src/core/parsing.ts"],"names":[],"mappings":"AAAA,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAM1D;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAYlE"}
+{"version":3,"file":"parsing.d.ts","sourceRoot":"","sources":["../../src/core/parsing.ts"],"names":[],"mappings":"AAcA,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAK1D;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKlE"}

package/dist/core/parsing.js

@@ -1,25 +1,28 @@
+import * as z from 'zod/v4';
+const SizeUnitSchema = z.enum(['B', 'KB', 'MB', 'GB']);
+const SIZE_UNITS = { B: 1, KB: 1024, MB: 1024 ** 2, GB: 1024 ** 3 };
+const DurationUnitSchema = z.enum(['s', 'm', 'h', 'd', 'w']);
+const DURATION_UNITS = {
+    s: 1000,
+    m: 60 * 1000,
+    h: 60 * 60 * 1000,
+    d: 24 * 60 * 60 * 1000,
+    w: 7 * 24 * 60 * 60 * 1000
+};
 export function parseSize(size) {
     if (!size)
         return 10 * 1024 * 1024;
-    const units = { B: 1, KB: 1024, MB: 1024 ** 2, GB: 1024 ** 3 };
     const match = size.match(/^(\d+(?:\.\d+)?)\s*(B|KB|MB|GB)$/i);
     if (!match)
         return 10 * 1024 * 1024;
-    return Math.floor(parseFloat(match[1]) * (units[match[2].toUpperCase()] ?? 1));
+    return Math.floor(parseFloat(match[1]) * SIZE_UNITS[SizeUnitSchema.parse(match[2].toUpperCase())]);
 }
 export function parseDuration(duration) {
     if (!duration)
         return 7 * 24 * 60 * 60 * 1000;
-    const units = {
-        s: 1000,
-        m: 60 * 1000,
-        h: 60 * 60 * 1000,
-        d: 24 * 60 * 60 * 1000,
-        w: 7 * 24 * 60 * 60 * 1000
-    };
     const match = duration.match(/^(\d+)\s*(s|m|h|d|w)$/i);
     if (!match)
         return 7 * 24 * 60 * 60 * 1000;
-    return parseInt(match[1], 10) * (units[match[2].toLowerCase()] ?? 1);
+    return parseInt(match[1], 10) * DURATION_UNITS[DurationUnitSchema.parse(match[2].toLowerCase())];
 }
 //# sourceMappingURL=parsing.js.map

package/dist/core/parsing.js.map

@@ -1 +1 @@
-{"version":3,"file":"parsing.js","sourceRoot":"","sources":["../../src/core/parsing.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,SAAS,CAAC,IAAwB;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IACnC,MAAM,KAAK,GAA2B,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;IACvF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAA4B;IACzD,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC9C,MAAM,KAAK,GAA2B;QACrC,CAAC,EAAE,IAAI;QACP,CAAC,EAAE,EAAE,GAAG,IAAI;QACZ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;QACjB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QACtB,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;KAC1B,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"parsing.js","sourceRoot":"","sources":["../../src/core/parsing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACvD,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,EAAoE,CAAC;AAEtI,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7D,MAAM,cAAc,GAAG;IACtB,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,EAAE,GAAG,IAAI;IACZ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACjB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IACtB,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CAC4C,CAAC;AAExE,MAAM,UAAU,SAAS,CAAC,IAAwB;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAA4B;IACzD,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,cAAc,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC"}

package/dist/core/redact.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Logging-owned redaction and structured error schemas.
+ *
+ * Raw values enter the published schemas. Redaction uses keys and secret()
+ * values; free text remains data. Parsing yields a detached snapshot.
+ *
+ * One rule governs every value read off an Error or a context: each field is
+ * read exactly once, inside a guard. A string is kept (and passes the same
+ * key and `secret()` redaction as everything else); any other value goes
+ * through the one redaction walk; a value that cannot be read is never
+ * carried: an Error is then described value-free, and a context refuses with
+ * a typed `ZodError` issue holding a fixed message and the path.
+ */
+import * as z from 'zod/v4';
+import type { LogContext } from '../schemas/entry.ts';
+export declare const REDACTED = "[REDACTED]";
+/**
+ * The credential words: a key (or query parameter name) whose last word is one
+ * of these names a credential. Matched as a whole word, never inside one, so
+ * `pwd`, `pass`, `pin`, `otp`, `totp`, `dbPwd` and `db_pass` are secret while `passage`,
+ * `bypass`, `spin` and `passCount` are not. A bare `key` is secret as the whole key only (the
+ * exact list), so `monkey`, `keyId`, `cacheKey` and `credentialKey` (which name
+ * a key, not hold one) stay readable. The endpoint scrubber's credential query
+ * parameters use the same rule (`isSecretKey`), so the two never disagree.
+ */
+export declare const CREDENTIAL_KEY_WORDS: readonly ["token", "secret", "password", "passwd", "pass", "pwd", "passphrase", "pin", "otp", "totp", "credential", "signature", "jwt", "bearer"];
+/**
+ * A string a caller hands in, refused as a `ZodError` issue for any other value.
+ * Zod's own `z.string()` describes a refused value's type with `Array.isArray`,
+ * which throws a `TypeError` for a revoked Proxy; this check reads only `typeof`.
+ */
+export declare const CallerStringSchema: z.ZodCustom<string, string>;
+/**
+ * Case- and separator-insensitive matching; token counts stay readable. A key
+ * is secret when its normalized form is a listed name, ends with a listed
+ * suffix or holds a listed infix (a bare `key` is listed), or when its last
+ * word is a credential word ({@link CREDENTIAL_KEY_WORDS}).
+ */
+export declare function isSecretKey(key: string): boolean;
+declare const SECRET_BRAND: unique symbol;
+/** A secret that redacts in serialization; reveal() is the explicit escape. */
+export declare class SecretValue {
+    #private;
+    readonly [SECRET_BRAND] = true;
+    constructor(value: string);
+    reveal(): string;
+    toJSON(): string;
+    toString(): string;
+}
+export declare function secret(value: string): SecretValue;
+/**
+ * Validates the branded secret protocol without copying the secret instance.
+ * Total: a value whose protocol reads throw (a trap, a getter, a revoked
+ * Proxy) is not a secret value and refuses as an issue, never rethrowing.
+ */
+export declare const SecretValueSchema: z.ZodCustom<SecretValue, SecretValue>;
+export declare const PlainLogRecordSchema: z.ZodCustom<Record<string, unknown>, Record<string, unknown>>;
+/** A complete, secret-free description of a thrown value. */
+export interface LoggedError {
+    name: string;
+    message: string;
+    code?: string | number;
+    reason?: string;
+    status?: number;
+    retryable?: boolean;
+    details?: unknown;
+    fields?: LogContext;
+    stack?: string;
+    cause?: LoggedError | unknown;
+    errors?: LoggedError[];
+}
+/**
+ * The breadth cap of the walk: an array keeps its first `MAX_WALK_BREADTH`
+ * items and an object its first `MAX_WALK_BREADTH` own enumerable keys (an
+ * AggregateError its first `MAX_WALK_BREADTH` members). What is past the cap
+ * is not read; it is described by one truncation marker holding the count
+ * left out ({@link truncationMarker}): a last array item, an object's
+ * {@link TRUNCATED_KEY} field, or a last aggregate member named `Truncated`.
+ * Ordinary contexts are far below it; a 100,000-item array is walked in a few
+ * milliseconds instead of the hundreds a full walk takes.
+ */
+export declare const MAX_WALK_BREADTH = 1000;
+/** The key an object's truncation marker is carried under. */
+export declare const TRUNCATED_KEY = "[Truncated]";
+/** The marker for `omitted` items, keys or members past the breadth cap. */
+export declare function truncationMarker(omitted: number): string;
+/**
+ * A caller primitive that JSON cannot carry, as the JSON value every sink can
+ * serialize: a bigint as its decimal string (`10n` -> `"10"`), a symbol as its
+ * `Symbol(description)` text, a function as `[Function]`, and NaN / Infinity /
+ * -Infinity as the strings `"NaN"`, `"Infinity"`, `"-Infinity"`. JSON primitives
+ * pass unchanged. No sink downstream of the walk can then throw on a value.
+ * A function is recognized by `typeof`, which no Proxy trap can intercept.
+ */
+export declare const FUNCTION_MARKER = "[Function]";
+/** The refusal message for a caller value that cannot be read: never what the read threw, which may carry the value. */
+export declare const UNREADABLE_LOG_VALUE_MESSAGE = "A log value could not be read (a getter, Proxy trap or conversion threw), so it cannot be snapshotted; what it threw is withheld because it may carry the value.";
+/** The refusal message for a value whose own JSON hook throws; the hook's failure value never travels with it. */
+export declare const JSON_HOOK_REFUSAL_MESSAGE = "A log value's toJSON hook threw, so the value cannot be snapshotted.";
+/**
+ * The named fields of a caller value (an audit input, a tracker's params), each
+ * read exactly once inside the guard, as a record of the raw values read; an
+ * absent field is left out, and a value that is not an object has no fields.
+ * A read that throws (a getter, a Proxy trap, a revoked Proxy) refuses with
+ * the value-free unreadable `ZodError` issue at that field's path: nothing it
+ * threw is carried, and the schema never throws it. The values read are still
+ * raw; the caller walks or validates them.
+ */
+export declare function createFieldsReadSchema(keys: readonly string[]): z.ZodType<LogContext>;
+/** What a thrown value's description says when describing it throws: never the thrown message, which a hostile getter or trap can fill with the value. */
+export declare const UNDESCRIBABLE_ERROR_MESSAGE = "The thrown value could not be described (a getter, toJSON, conversion or Proxy trap threw); its message is withheld because it may carry the value.";
+/**
+ * The name a value-free description carries: a provable Error's own name when it
+ * reads without throwing and is a plain identifier naming no secret, else
+ * `Error`; `NonError` for anything not provably an Error (`instanceof` reads the
+ * prototype, which a Proxy trap or a revoked Proxy throws from).
+ */
+export declare const ReadableErrorNameSchema: z.ZodPipe<z.ZodUnknown, z.ZodTransform<string, unknown>>;
+/** Describes a thrown value without the value: its readable error name and the fixed `message`. */
+export declare function valueFreeFailureSchema(message: string): z.ZodType<LoggedError>;
+/** A thrown value's description, and whether it is the full one (`false`: describing it threw, so it is value-free). */
+export interface ThrownValueDescription {
+    readonly error: LoggedError;
+    readonly described: boolean;
+}
+/**
+ * The total describer of a thrown value, with the message its value-free form
+ * carries. It never throws, for any input, and its description is JSON.
+ */
+export declare function createThrownValueSchema(undescribable: string): z.ZodType<ThrownValueDescription>;
+/** {@link createThrownValueSchema} with {@link UNDESCRIBABLE_ERROR_MESSAGE}. */
+export declare const ThrownValueSchema: z.ZodType<ThrownValueDescription, unknown, z.core.$ZodTypeInternals<ThrownValueDescription, unknown>>;
+/**
+ * Raw thrown values normalize here, including primitives and non-Error objects.
+ * Total: it never throws. An ordinary Error is described in full (name,
+ * message, metadata, redacted details and fields, stack, cause chain,
+ * aggregate members), each field read once: a string field is kept, a
+ * non-string one is walked and carried as its redacted JSON text. A value
+ * whose description throws is described as its readable error name
+ * (`ReadableErrorNameSchema`) and `UNDESCRIBABLE_ERROR_MESSAGE`, and a cause or
+ * aggregate member that cannot be described is described that way in place.
+ */
+export declare const LoggedErrorSchema: z.ZodPipe<z.ZodType<ThrownValueDescription, unknown, z.core.$ZodTypeInternals<ThrownValueDescription, unknown>>, z.ZodTransform<LoggedError, ThrownValueDescription>>;
+/** A thrown value's message for a report line, through the total describer: never throws, never the text of a value that cannot be described. */
+export declare const ThrownMessageSchema: z.ZodPipe<z.ZodType<ThrownValueDescription, unknown, z.core.$ZodTypeInternals<ThrownValueDescription, unknown>>, z.ZodTransform<string, ThrownValueDescription>>;
+/**
+ * The one nested-value schema. A consumer that parses a value with it owns a
+ * detached, redacted snapshot: secret keys and `secret()` values are replaced,
+ * Errors become `LoggedError` (described in place by the total describer),
+ * every object's callable `toJSON` runs exactly once and its returned value is
+ * normalized the same way, and no caller container is retained. A value that
+ * cannot be read (a getter or Proxy trap throws) or whose hook throws refuses
+ * with a `ZodError` issue holding a fixed message and the path; nothing the
+ * value threw is carried, and the schema never throws it. `JSON.stringify` of
+ * the result runs no hook.
+ */
+export declare const RedactedLogValueSchema: z.ZodPipe<z.ZodUnknown, z.ZodTransform<unknown, unknown>>;
+/** The emitted path reuses {@link RedactedLogValueSchema}: delivery and the public schema are one contract. */
+export declare const EmittedLogValueSchema: z.ZodPipe<z.ZodUnknown, z.ZodTransform<unknown, unknown>>;
+export {};
+//# sourceMappingURL=redact.d.ts.map

package/dist/core/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/core/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGtD,eAAO,MAAM,QAAQ,eAAe,CAAC;AA4BrC;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,mJAEvB,CAAC;AAQX;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,6BAA6G,CAAC;AAE7I;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAShD;AAED,QAAA,MAAM,YAAY,eAA2C,CAAC;AAE9D,+EAA+E;AAC/E,qBAAa,WAAW;;IACvB,QAAQ,CAAC,CAAC,YAAY,CAAC,QAAQ;gBAEnB,KAAK,EAAE,MAAM;IACzB,MAAM,IAAI,MAAM;IAChB,MAAM,IAAI,MAAM;IAChB,QAAQ,IAAI,MAAM;CAElB;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAEjD;AAMD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,uCAM5B,CAAC;AAkBH,eAAO,MAAM,oBAAoB,+DAK/B,CAAC;AAEH,6DAA6D;AAC7D,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACvB;AAKD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,OAAO,CAAC;AACrC,8DAA8D;AAC9D,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAC3C,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAyDD;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,eAAe,CAAC;AAY5C,wHAAwH;AACxH,eAAO,MAAM,4BAA4B,qKAAqK,CAAC;AAE/M,kHAAkH;AAClH,eAAO,MAAM,yBAAyB,yEAA0E,CAAC;AAqEjH;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAcrF;AA6LD,0JAA0J;AAC1J,eAAO,MAAM,2BAA2B,wJAAwJ,CAAC;AAKjM;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,0DAMlC,CAAC;AAEH,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAE9E;AAED,wHAAwH;AACxH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC5B;AA2BD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAEhG;AAED,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,uGAAuD,CAAC;AAEtF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,uKAAqE,CAAC;AAEpG,iJAAiJ;AACjJ,eAAO,MAAM,mBAAmB,kKAAwE,CAAC;AAEzG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,2DAOjC,CAAC;AAEH,+GAA+G;AAC/G,eAAO,MAAM,qBAAqB,2DAAyB,CAAC"}