@wenrwa/marketplace-cli 0.8.4 → 0.8.6

package/dist/secrets/redact.js

@@ -0,0 +1,637 @@
+"use strict";
+/**
+ * Secret masking for terminal output (owner-approved 2026-10-17).
+ *
+ * A secret pasted or printed in any HiveOp terminal must never reach anyone's
+ * screen — the owner's own view included (they stream and screenshot). The PTY
+ * child still gets the real bytes; only what is DISPLAYED or SENT is masked.
+ *
+ * ONE SOURCE OF TRUTH. backend/src/lib/secrets/redact.ts is a byte-identical
+ * copy (the backend cannot import from cli/), and a backend test fails the
+ * moment the two differ. Edit this file, then copy it over.
+ *
+ * Exports:
+ *   - findSecrets(text)           spans a plain string would mask
+ *   - containsSecret(text)        true when findSecrets finds anything
+ *   - redact(text)                one-shot, ANSI-aware masking of a whole string
+ *   - createStreamRedactor(opts)  the same for a chunked PTY stream
+ *
+ * Masking is LENGTH-PRESERVING: every hidden character becomes one '*'. That
+ * keeps every column a TUI drew where it drew it (a shorter line would leave
+ * stale cells behind a cursor-addressed repaint), keeps patch byte sizes, and
+ * lets a value that arrives in two pieces be masked piece by piece. Prefixed
+ * tokens keep their first 4 characters (`npm_****…`); a NAME=value keeps the
+ * name (`RAILWAY_API_TOKEN=****…`). '*' is ASCII, so it is one cell wide in
+ * every terminal, and a re-scan of masked text finds nothing (idempotent).
+ *
+ * Streaming: output arrives in arbitrary chunks, interleaved with escape
+ * sequences. Escapes pass through untouched (OSC titles are masked inside);
+ * text is matched on a "visible" view with SGR colour codes removed, so a
+ * token painted in two colours is still one token. A tail that could still be
+ * the start of a secret is held back (bounded) and released on the next chunk
+ * or after a short idle, so interactive echo stays snappy.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MASK_CHAR = void 0;
+exports.isSecretName = isSecretName;
+exports.findSecrets = findSecrets;
+exports.containsSecret = containsSecret;
+exports.createStreamRedactor = createStreamRedactor;
+exports.redact = redact;
+exports.redactInSlices = redactInSlices;
+exports.MASK_CHAR = '*';
+// ── value / name rules ───────────────────────────────────────────────────────
+/** Characters a secret value may be made of. Excludes whitespace, quotes,
+ *  backslash (keeps JSON escapes intact), `$` (a `$VAR` reference is never a
+ *  literal), shell/code punctuation and control characters. */
+const VCH = "[^\\s\"'`\\\\;,(){}\\[\\]<>$|&\\x00-\\x1f\\x7f]";
+const PLACEHOLDER_WORDS = /(x{5,}|your[-_ ]?|example|placeholder|changeme|change[-_]me|redacted|dummy|sample|<|>|\.\.\.|…)/i;
+/** True when `v` reads as a real secret value, not code, a path or a placeholder. */
+function plausibleValue(v, opts) {
+    if (v.length < opts.minLen)
+        return false;
+    if (/^[*•.\-_xX0#=]+$/.test(v))
+        return false; // masks and filler
+    if (/^(true|false|null|undefined|none|nil|yes|no|on|off|empty|unset|hidden)$/i.test(v))
+        return false;
+    if (/^(\/|\.\.?\/|~\/|[A-Za-z]:[\\/])/.test(v))
+        return false; // file paths
+    if (/^[A-Za-z][A-Za-z0-9+.\-]*:\/\//.test(v))
+        return false; // URLs (creds handled separately)
+    if (PLACEHOLDER_WORDS.test(v))
+        return false;
+    if (/^v?\d+([.:\-]\d+)*$/.test(v))
+        return false; // numbers, versions, times
+    if (/^\d{4}-\d{2}-\d{2}/.test(v))
+        return false; // ISO dates
+    if (/^v?\d+\.\d+\.\d+/.test(v))
+        return false; // semver-ish
+    if (/^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)+$/.test(v))
+        return false; // a.b.c code path
+    if (/^pk_(live|test)_/.test(v))
+        return false; // Stripe publishable keys are public
+    if (opts.needDigit && !/\d/.test(v))
+        return false;
+    return true;
+}
+const STRONG_SEGMENTS = new Set([
+    'token', 'secret', 'secrets', 'password', 'passwords', 'passwd', 'passphrase', 'pwd', 'pass',
+    'credential', 'credentials', 'creds', 'apikey', 'privatekey', 'secretkey', 'accesskey', 'auth',
+    'jwt', 'bearer', 'cookie',
+]);
+/** `<word>_KEY` names that are NOT secrets (cache keys, sort keys, …). */
+const KEY_EXCLUDE = new Set([
+    'cache', 'sort', 'partition', 'primary', 'foreign', 'query', 'storage', 'idempotency', 'map',
+    'object', 'hash', 'row', 'unique', 'composite', 'lookup', 'dedupe', 'dedup', 'group', 'routing',
+    'shard', 'public', 'publishable', 'react', 'list', 'dict', 'index', 'cursor', 'sequence', 'sort',
+    'message', 'translation', 'i18n', 'locale', 'host', 'item', 'node', 'field', 'column', 'table',
+    'record', 'entry', 'state', 'store', 'redis', 'bucket', 'file', 'path', 'meta', 'event',
+]);
+/** True when an identifier names a secret: RAILWAY_API_TOKEN, apiKey, --password, x-api-key. */
+function isSecretName(name) {
+    const segs = name
+        .replace(/^-+/, '')
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .toLowerCase()
+        .split(/[_.\-]+/)
+        .filter(Boolean);
+    if (segs.length === 0 || segs.length > 10)
+        return false;
+    if (segs.includes('public') || segs.includes('publishable'))
+        return false;
+    for (let i = 0; i < segs.length; i++) {
+        const s = segs[i];
+        if (STRONG_SEGMENTS.has(s))
+            return true;
+        if (s.length > 5 && (s.endsWith('token') || s.endsWith('secret') || s.endsWith('password') || s.endsWith('apikey')))
+            return true;
+        if ((s === 'key' || s === 'keys') && i > 0 && !KEY_EXCLUDE.has(segs[i - 1]))
+            return true;
+    }
+    return false;
+}
+// ── patterns ─────────────────────────────────────────────────────────────────
+//
+// Every pattern either starts with a literal or is guarded by a lookbehind that
+// stops it starting in the middle of a run of its own leading class — without
+// that, a long run (a hex dump, a TUI line of 60k cells) is scanned once per
+// start position, which is quadratic. The adversarial perf test pins this.
+const B = '(?<![A-Za-z0-9_\\-])'; // token boundary
+/** Known prefixed token formats. Group 1 is the token; the first 4 chars stay visible. */
+const PREFIXED = [
+    /sk-ant-[A-Za-z0-9_\-]{20,}/,
+    /sk-(?:or-|proj-|svcacct-|admin-)?[A-Za-z0-9_\-]{20,}/,
+    /npm_[A-Za-z0-9]{20,}/,
+    /(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/,
+    /github_pat_[A-Za-z0-9_]{20,}/,
+    /glpat-[A-Za-z0-9_\-]{20,}/,
+    /xox[abprse]-[A-Za-z0-9\-]{10,}/,
+    /(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}/,
+    /(?:AKIA|ASIA)[A-Z0-9]{16}(?![A-Za-z0-9])/,
+    /AIza[A-Za-z0-9_\-]{30,}/,
+    /eyJ[A-Za-z0-9_\-]{6,}\.[A-Za-z0-9_\-]{6,}\.[A-Za-z0-9_\-]{6,}/,
+    /wm_(?:sk|ct)_[A-Za-z0-9_\-]{12,}/,
+    /hf_[A-Za-z0-9]{30,}/,
+    /sbp_[a-f0-9]{30,}/,
+    /sb_secret_[A-Za-z0-9_\-]{16,}/,
+    /SG\.[A-Za-z0-9_\-]{16,}\.[A-Za-z0-9_\-]{16,}/,
+    /fm[12]_[A-Za-z0-9_\-+\/=,]{20,}/,
+    /lin_api_[A-Za-z0-9]{20,}/,
+    /pypi-[A-Za-z0-9_\-]{30,}/,
+    /dop_v1_[a-f0-9]{30,}/,
+].map((r) => new RegExp(`${B}(${r.source})`, 'g'));
+/** Prefixes for the hold-back test: a trailing run starting with one may still be growing. */
+const KNOWN_PREFIXES = [
+    'sk-', 'npm_', 'ghp_', 'gho_', 'ghu_', 'ghs_', 'ghr_', 'github_pat_', 'glpat-', 'xoxa-', 'xoxb-',
+    'xoxp-', 'xoxr-', 'xoxs-', 'xoxe-', 'sk_live_', 'sk_test_', 'rk_live_', 'rk_test_', 'AKIA', 'ASIA',
+    'AIza', 'eyJ', 'wm_sk_', 'wm_ct_', 'hf_', 'sbp_', 'sb_secret_', 'SG.', 'fm1_', 'fm2_', 'lin_api_',
+    'pypi-', 'dop_v1_',
+];
+const NAME = '[A-Za-z_][A-Za-z0-9_.\\-]*';
+/** A NAME that contains a secret-ish word (the regex prefilter; isSecretName
+ *  decides). Bounded so a 60k-cell identifier run cannot backtrack for long. */
+const KW_NAME = '(?=[A-Za-z_])[A-Za-z0-9_.\\-]{0,64}?(?:[Tt][Oo][Kk][Ee][Nn]|[Ss][Ee][Cc][Rr][Ee][Tt]|[Pp][Aa][Ss][Ss]|[Pp][Ww][Dd]|[Cc][Rr][Ee][Dd]|[Aa][Uu][Tt][Hh]|[Kk][Ee][Yy]|[Jj][Ww][Tt]|[Bb][Ee][Aa][Rr][Ee][Rr]|[Cc][Oo][Oo][Kk][Ii][Ee])[A-Za-z0-9_.\\-]{0,64}';
+const HS = '[^\\S\\r\\n]*'; // horizontal whitespace
+/** NAME=value, NAME: value, "name": "value", export NAME='value'. Groups: 1 name, 2 value. */
+const ASSIGN_RE = new RegExp(`(?<![A-Za-z0-9_.\\-])(?:\\\\?["'])?(${KW_NAME})(?![A-Za-z0-9_.\\-])(?:\\\\?["'])?${HS}(?:=|:(?!\\/\\/))(?!=)${HS}(?:\\\\?["'])?(${VCH}+)`, 'g');
+/** --token value / --api-key=value. Groups: 1 flag name, 2 value. */
+const FLAG_RE = new RegExp(`(?<![A-Za-z0-9_\\-])--?([A-Za-z][A-Za-z0-9_\\-]*)(?:=|[^\\S\\r\\n]+)["']?(${VCH}+)`, 'g');
+/** Authorization: <scheme> <value>. Group 1 value. */
+const AUTH_HEADER_RE = new RegExp(`(?<![A-Za-z0-9_\\-])(?:Proxy-)?Authorization["']?${HS}[:=]${HS}["']?(?:(?:Bearer|Basic|Token|Bot|Digest)[^\\S\\r\\n]+)?(${VCH}+)`, 'gi');
+/** Bearer <value> anywhere. Group 1 value. */
+const BEARER_RE = new RegExp(`(?<![A-Za-z0-9_\\-])Bearer[^\\S\\r\\n]+(${VCH}+)`, 'gi');
+/** scheme://user:password@host. Group 1 password. */
+const URL_CRED_RE = /:\/\/[^\s:\/@"'<>]+:([^\s\/@"'<>$]+)@/g;
+const PEM_BEGIN_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g;
+const PEM_END_RE = /-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g;
+const PEM_RUN_RE = /[A-Za-z0-9+\/=]{8,}/g;
+/** Give up on an unterminated key block after this many characters. */
+const PEM_BUDGET = 16_384;
+// ── hold-back (streaming) ────────────────────────────────────────────────────
+/** Trailing, still-growing forms (anchored at the end of a line tail). Group 1 = value so far. */
+const TRAIL_ASSIGN_RE = new RegExp(`(?<![A-Za-z0-9_.\\-])(?:\\\\?["'])?(${NAME})(?:\\\\?["'])?${HS}(?:=|:(?!\\/\\/))(?!=)${HS}(?:\\\\?["'])?(${VCH}*)$`);
+const TRAIL_FLAG_RE = new RegExp(`(?<![A-Za-z0-9_\\-])--?([A-Za-z][A-Za-z0-9_\\-]*)(?:=|[^\\S\\r\\n]+)["']?(${VCH}*)$`);
+const TRAIL_BEARER_RE = new RegExp(`(?:Authorization["']?${HS}[:=]${HS}["']?(?:(?:Bearer|Basic|Token|Bot|Digest)[^\\S\\r\\n]+)?|Bearer[^\\S\\r\\n]+)(${VCH}*)$`, 'i');
+const TRAIL_URL_RE = /:\/\/[^\s:\/@"'<>]+:([^\s\/@"'<>$]*)$/;
+const TRAIL_RUN_RE = /(?<![A-Za-z0-9_\-.+\/=,])[A-Za-z0-9_\-.+\/=,]+$/;
+/** How far back (visible chars) the trailing checks look. */
+const TAIL_WINDOW = 600;
+function pushSpan(out, start, end, kind) {
+    if (end > start)
+        out.push({ start, end, kind });
+}
+function detectStatic(v, out) {
+    for (const re of PREFIXED) {
+        re.lastIndex = 0;
+        let m;
+        while ((m = re.exec(v))) {
+            const tok = m[1];
+            const body = tok.slice(4);
+            if (/\d/.test(body) && /[A-Za-z]/.test(body) && !PLACEHOLDER_WORDS.test(tok) && !/^(.)\1+$/.test(body)) {
+                pushSpan(out, m.index + 4, m.index + tok.length, 'prefixed');
+            }
+        }
+    }
+    const valueAt = (m, group) => m.index + m[0].length - m[group].length;
+    let m;
+    ASSIGN_RE.lastIndex = 0;
+    while ((m = ASSIGN_RE.exec(v))) {
+        if (isSecretName(m[1]) && plausibleValue(m[2], { minLen: 12, needDigit: true })) {
+            const s = valueAt(m, 2);
+            pushSpan(out, s, s + m[2].length, 'assignment');
+        }
+    }
+    FLAG_RE.lastIndex = 0;
+    while ((m = FLAG_RE.exec(v))) {
+        if (isSecretName(m[1]) && plausibleValue(m[2], { minLen: 12, needDigit: true })) {
+            const s = valueAt(m, 2);
+            pushSpan(out, s, s + m[2].length, 'assignment');
+        }
+    }
+    AUTH_HEADER_RE.lastIndex = 0;
+    while ((m = AUTH_HEADER_RE.exec(v))) {
+        if (plausibleValue(m[1], { minLen: 8, needDigit: false }) && !/^(Bearer|Basic|Token|Bot|Digest)$/i.test(m[1])) {
+            const s = valueAt(m, 1);
+            pushSpan(out, s, s + m[1].length, 'bearer');
+        }
+    }
+    BEARER_RE.lastIndex = 0;
+    while ((m = BEARER_RE.exec(v))) {
+        if (plausibleValue(m[1], { minLen: 12, needDigit: true })) {
+            const s = valueAt(m, 1);
+            pushSpan(out, s, s + m[1].length, 'bearer');
+        }
+    }
+    URL_CRED_RE.lastIndex = 0;
+    while ((m = URL_CRED_RE.exec(v))) {
+        const pw = m[1];
+        if (!/^[*]+$/.test(pw)) {
+            const s = m.index + m[0].length - 1 - pw.length;
+            pushSpan(out, s, s + pw.length, 'url-credential');
+        }
+    }
+}
+/** Private-key blocks: mask base64 runs between BEGIN and END, across chunks. */
+function detectPem(v, boundary, state, out) {
+    let inPem = state.inPem;
+    let budget = state.pemBudget;
+    let cur = inPem ? boundary : 0;
+    for (;;) {
+        if (inPem) {
+            PEM_END_RE.lastIndex = Math.max(0, cur - 64);
+            let end;
+            while ((end = PEM_END_RE.exec(v)) && end.index + end[0].length <= cur) { /* skip already-seen */ }
+            const regionEnd = end ? end.index : v.length;
+            const region = v.slice(cur, regionEnd);
+            PEM_RUN_RE.lastIndex = 0;
+            let r;
+            while ((r = PEM_RUN_RE.exec(region)))
+                pushSpan(out, cur + r.index, cur + r.index + r[0].length, 'private-key');
+            if (end) {
+                inPem = false;
+                cur = end.index + end[0].length;
+                continue;
+            }
+            if (cur >= boundary)
+                budget -= region.length;
+            if (budget <= 0)
+                inPem = false;
+            break;
+        }
+        PEM_BEGIN_RE.lastIndex = Math.max(0, cur, boundary - 64);
+        let begin;
+        while ((begin = PEM_BEGIN_RE.exec(v)) && begin.index + begin[0].length <= boundary) { /* emitted before */ }
+        if (!begin || begin.index + begin[0].length < cur)
+            break;
+        inPem = true;
+        budget = PEM_BUDGET;
+        cur = begin.index + begin[0].length;
+    }
+    return { inPem, pemBudget: budget };
+}
+/** Where a still-growing secret starts at the end of `v` (v.length when none). */
+function holdPoint(v, state) {
+    let lineStart = Math.max(v.lastIndexOf('\n'), v.lastIndexOf('\r')) + 1;
+    if (state.inPem) {
+        // Hold the unfinished key line so an END marker is never split.
+        return v.length - lineStart <= 256 ? lineStart : v.length;
+    }
+    lineStart = Math.max(lineStart, v.length - TAIL_WINDOW);
+    const tail = v.slice(lineStart);
+    let hold = v.length;
+    const at = (m, group) => m ? lineStart + m.index + m[0].length - m[group].length : v.length;
+    const a = TRAIL_ASSIGN_RE.exec(tail);
+    if (a && a[2] && isSecretName(a[1]))
+        hold = Math.min(hold, at(a, 2));
+    const f = TRAIL_FLAG_RE.exec(tail);
+    if (f && f[2] && isSecretName(f[1]))
+        hold = Math.min(hold, at(f, 2));
+    const b = TRAIL_BEARER_RE.exec(tail);
+    if (b && b[1])
+        hold = Math.min(hold, at(b, 1));
+    const u = TRAIL_URL_RE.exec(tail);
+    if (u && u[1])
+        hold = Math.min(hold, at(u, 1));
+    const run = TRAIL_RUN_RE.exec(tail);
+    if (run && KNOWN_PREFIXES.some((p) => run[0].startsWith(p))) {
+        hold = Math.min(hold, lineStart + run.index + Math.min(4, run[0].length));
+    }
+    return hold;
+}
+/** In-progress values at the very end, masked on a final flush (typed secrets). */
+function trailingInProgress(v, out) {
+    const lineStart = Math.max(Math.max(v.lastIndexOf('\n'), v.lastIndexOf('\r')) + 1, v.length - TAIL_WINDOW);
+    const tail = v.slice(lineStart);
+    const a = TRAIL_ASSIGN_RE.exec(tail) ?? TRAIL_FLAG_RE.exec(tail);
+    if (a && a[2] && isSecretName(a[1]) &&
+        plausibleValue(a[2], { minLen: 3, needDigit: false }) && (/\d/.test(a[2]) || a[2].length >= 8)) {
+        const s = lineStart + a.index + a[0].length - a[2].length;
+        pushSpan(out, s, v.length, 'assignment');
+    }
+    const run = TRAIL_RUN_RE.exec(tail);
+    if (run && run[0].length > 4 && KNOWN_PREFIXES.some((p) => run[0].startsWith(p) && run[0].length > p.length)) {
+        pushSpan(out, lineStart + run.index + 4, v.length, 'prefixed');
+    }
+}
+function scan(v, boundary, state, final, maskTrailing = false) {
+    const spans = [];
+    detectStatic(v, spans);
+    const next = detectPem(v, boundary, state, spans);
+    let hold = v.length;
+    if (!final)
+        hold = Math.max(boundary, holdPoint(v, next));
+    else if (maskTrailing)
+        trailingInProgress(v, spans);
+    return { spans: spans.filter((s) => s.end > boundary), hold, state: next };
+}
+/** Spans a plain (escape-free) string would mask, sorted and merged. */
+function findSecrets(text) {
+    const { spans } = scan(text, 0, { inPem: false, pemBudget: 0 }, true);
+    spans.sort((x, y) => x.start - y.start);
+    const merged = [];
+    for (const s of spans) {
+        const last = merged[merged.length - 1];
+        if (last && s.start <= last.end)
+            last.end = Math.max(last.end, s.end);
+        else
+            merged.push({ ...s });
+    }
+    return merged;
+}
+/** True when `text` holds anything findSecrets would mask. */
+function containsSecret(text) {
+    return findSecrets(text).length > 0;
+}
+function maskPlain(text) {
+    const spans = findSecrets(text);
+    if (spans.length === 0)
+        return text;
+    let out = '';
+    let pos = 0;
+    for (const s of spans) {
+        out += text.slice(pos, s.start) + exports.MASK_CHAR.repeat(s.end - s.start);
+        pos = s.end;
+    }
+    return out + text.slice(pos);
+}
+const ESC = '\x1b';
+const MAX_OSC = 4096;
+const MAX_STRING_HOLD = 65_536;
+/** Classify a complete CSI by its final byte. */
+function csiVisible(seq) {
+    const final = seq[seq.length - 1];
+    if (final === 'm')
+        return ''; // colours
+    if (final === 'C')
+        return ' '; // cursor forward stands in for spaces
+    if (/[ABDEFGHJKLMPSTXdfr@`ae]/.test(final))
+        return '\n'; // moves / erases separate words
+    return ''; // modes, queries, sync markers…
+}
+/**
+ * Split raw PTY output into text runs and escape sequences. `inString` says
+ * the previous chunk ended inside an opaque string (DCS/APC/…) that has
+ * already been passed through; its continuation is consumed opaquely.
+ */
+function tokenize(raw, inString, final) {
+    const elements = [];
+    let i = 0;
+    const findST = (from) => {
+        for (let j = from; j < raw.length; j++) {
+            if (raw[j] === '\x07')
+                return j + 1;
+            if (raw[j] === ESC && raw[j + 1] === '\\')
+                return j + 2;
+        }
+        return -1;
+    };
+    if (inString) {
+        const end = findST(0);
+        if (end === -1) {
+            // Still inside; pass it all through (a lone trailing ESC may begin ST).
+            const keep = !final && raw.endsWith(ESC) ? 1 : 0;
+            if (raw.length - keep > 0)
+                elements.push({ raw: raw.slice(0, raw.length - keep), vis: '', text: false });
+            return { elements, rest: raw.slice(raw.length - keep), inString: true };
+        }
+        elements.push({ raw: raw.slice(0, end), vis: '', text: false });
+        i = end;
+    }
+    let textStart = i;
+    const flushText = (to) => {
+        if (to > textStart)
+            elements.push({ raw: raw.slice(textStart, to), vis: raw.slice(textStart, to), text: true });
+    };
+    while (i < raw.length) {
+        if (raw[i] !== ESC) {
+            i++;
+            continue;
+        }
+        flushText(i);
+        const start = i;
+        const next = raw[i + 1];
+        if (next === undefined) {
+            if (final) {
+                elements.push({ raw: ESC, vis: '', text: false });
+                i++;
+                textStart = i;
+                continue;
+            }
+            return { elements, rest: raw.slice(start), inString: false };
+        }
+        if (next === '[') {
+            let j = i + 2;
+            while (j < raw.length && raw.charCodeAt(j) >= 0x20 && raw.charCodeAt(j) <= 0x3f)
+                j++;
+            if (j >= raw.length) {
+                if (final) {
+                    elements.push({ raw: raw.slice(start), vis: '', text: false });
+                    i = raw.length;
+                    textStart = i;
+                    continue;
+                }
+                return { elements, rest: raw.slice(start), inString: false };
+            }
+            const seq = raw.slice(start, j + 1);
+            elements.push({ raw: seq, vis: csiVisible(seq), text: false });
+            i = j + 1;
+        }
+        else if (next === ']') {
+            const end = findST(i + 2);
+            if (end === -1) {
+                if (!final && raw.length - start <= MAX_OSC)
+                    return { elements, rest: raw.slice(start), inString: false };
+                // Too long (or flushing): pass through unmasked as an opaque string.
+                elements.push({ raw: raw.slice(start), vis: '', text: false });
+                return { elements, rest: '', inString: !final };
+            }
+            const seq = raw.slice(start, end);
+            const termLen = seq.endsWith('\x07') ? 1 : 2;
+            const body = seq.slice(2, seq.length - termLen);
+            elements.push({ raw: ESC + ']' + maskPlain(body) + seq.slice(seq.length - termLen), vis: '', text: false });
+            i = end;
+        }
+        else if (next === 'P' || next === '_' || next === '^' || next === 'X') {
+            const end = findST(i + 2);
+            if (end === -1) {
+                if (!final && raw.length - start <= MAX_STRING_HOLD)
+                    return { elements, rest: raw.slice(start), inString: false };
+                elements.push({ raw: raw.slice(start), vis: '', text: false });
+                return { elements, rest: '', inString: !final };
+            }
+            elements.push({ raw: raw.slice(start, end), vis: '', text: false });
+            i = end;
+        }
+        else {
+            // ESC [intermediates] final — charset selects, save/restore cursor, keypad modes.
+            let j = i + 1;
+            while (j < raw.length && raw.charCodeAt(j) >= 0x20 && raw.charCodeAt(j) <= 0x2f)
+                j++;
+            if (j >= raw.length) {
+                if (final) {
+                    elements.push({ raw: raw.slice(start), vis: '', text: false });
+                    i = raw.length;
+                    textStart = i;
+                    continue;
+                }
+                return { elements, rest: raw.slice(start), inString: false };
+            }
+            const seq = raw.slice(start, j + 1);
+            elements.push({ raw: seq, vis: next === '7' || next === '8' || next === 'D' || next === 'E' || next === 'M' ? '\n' : '', text: false });
+            i = j + 1;
+        }
+        textStart = i;
+    }
+    flushText(raw.length);
+    return { elements, rest: '', inString: false };
+}
+/** `text` with every position flagged in `masked` (offset by `base`) replaced by MASK_CHAR. */
+function maskText(text, masked, base) {
+    if (!masked)
+        return text;
+    let out = '';
+    let from = 0;
+    for (let c = 0; c < text.length; c++) {
+        if (masked[base + c]) {
+            out += text.slice(from, c) + exports.MASK_CHAR;
+            from = c + 1;
+        }
+    }
+    return out + text.slice(from);
+}
+/** Visible characters of already-emitted output kept for matching across chunks. */
+const CONTEXT = 512;
+function createStreamRedactor(opts) {
+    const idleMs = opts.idleMs ?? 30;
+    const maxHold = opts.maxHold ?? 512;
+    const maskTrailing = opts.maskTrailing ?? true;
+    const setTimer = opts.setTimer ?? ((cb, ms) => setTimeout(cb, ms));
+    const clearTimer = opts.clearTimer ?? ((h) => clearTimeout(h));
+    let pending = '';
+    let context = '';
+    let inString = false;
+    let state = { inPem: false, pemBudget: 0 };
+    let timer = null;
+    const run = (raw, final) => {
+        if (!raw)
+            return;
+        const tok = tokenize(raw, inString, final);
+        let vis = '';
+        for (const el of tok.elements)
+            vis += el.vis;
+        const v = context + vis;
+        const boundary = context.length;
+        const res = scan(v, boundary, state, final, final && maskTrailing);
+        let hold = res.hold;
+        if (v.length - hold > maxHold)
+            hold = v.length;
+        const holdLocal = hold - boundary; // index into vis
+        let masked = null;
+        for (const s of res.spans) {
+            masked ??= new Uint8Array(vis.length);
+            for (let k = Math.max(s.start, boundary); k < s.end && k < v.length; k++)
+                masked[k - boundary] = 1;
+        }
+        // Emit elements until the one owning the first held visible char.
+        let out = '';
+        let held = '';
+        let k = 0; // visible index at the start of the current element
+        let cut = false;
+        for (const el of tok.elements) {
+            if (cut) {
+                held += el.raw;
+                continue;
+            }
+            const end = k + el.vis.length;
+            if (holdLocal < end) {
+                // The hold starts inside this element.
+                cut = true;
+                if (!el.text) {
+                    held += el.raw;
+                    continue;
+                }
+                const off = holdLocal - k;
+                out += maskText(el.raw.slice(0, off), masked, k);
+                held += el.raw.slice(off);
+                continue;
+            }
+            out += el.text ? maskText(el.raw, masked, k) : el.raw;
+            k = end;
+        }
+        held += tok.rest;
+        // Only state that covers EMITTED text advances; a held tail is rescanned.
+        state = holdLocal >= vis.length ? res.state : scan(v.slice(0, hold), boundary, state, true).state;
+        inString = tok.inString;
+        context = (context + vis.slice(0, Math.max(0, holdLocal))).slice(-CONTEXT);
+        pending = held;
+        if (out)
+            opts.emit(out);
+    };
+    const stopTimer = () => {
+        if (timer !== null) {
+            clearTimer(timer);
+            timer = null;
+        }
+    };
+    const flush = () => {
+        stopTimer();
+        const raw = pending;
+        pending = '';
+        run(raw, true);
+        // A final pass never holds; anything left is an escape it could not finish.
+        if (pending) {
+            const p = pending;
+            pending = '';
+            opts.emit(p);
+        }
+    };
+    return {
+        push(chunk) {
+            if (!chunk)
+                return;
+            const raw = pending + chunk;
+            pending = '';
+            run(raw, false);
+            if (pending.length > MAX_STRING_HOLD + MAX_OSC) {
+                flush();
+                return;
+            }
+            if (pending && timer === null)
+                timer = setTimer(() => { timer = null; flush(); }, idleMs);
+            if (!pending)
+                stopTimer();
+        },
+        flush,
+        dispose() {
+            flush();
+            stopTimer();
+        },
+    };
+}
+/** One-shot, ANSI-aware masking of a complete string (logs, replays, screens, files). */
+function redact(text) {
+    if (!text)
+        return text;
+    let out = '';
+    const r = createStreamRedactor({ emit: (s) => { out += s; }, maskTrailing: false, setTimer: () => null, clearTimer: () => { } });
+    r.push(text);
+    r.flush();
+    return out;
+}
+/**
+ * redact() for large text (a multi-MB transcript) without blocking the event
+ * loop: the same stream redactor fed in slices, yielding between them so live
+ * terminal frames keep flowing. Same result as redact(text).
+ */
+async function redactInSlices(text, sliceChars = 1 << 20) {
+    if (text.length <= sliceChars)
+        return redact(text);
+    let out = '';
+    const r = createStreamRedactor({ emit: (s) => { out += s; }, maskTrailing: false, setTimer: () => null, clearTimer: () => { } });
+    for (let i = 0; i < text.length; i += sliceChars) {
+        r.push(text.slice(i, i + sliceChars));
+        await new Promise((resolve) => setImmediate(resolve));
+    }
+    r.flush();
+    return out;
+}