@yolk-sdk/conformance 0.1.0-canary.96

package/dist/runner.mjs

@@ -0,0 +1,264 @@
+import { ConformanceMismatch } from "./case.mjs";
+import { redactCredentialText } from "./wire-internal.mjs";
+import { conformanceFixtureEvidence, fixtureAgeDays } from "./fixture.mjs";
+import { Cause, Clock, Effect, Exit, Option, Predicate } from "effect";
+//#region src/runner.ts
+/**
+* Conformance runner: decides which cases may run against a target (safety
+* policy), runs each allowed case in isolation with freshly built layers, and
+* produces a plain-data report.
+*
+* The runner never performs network I/O itself; whatever the per-case layer
+* provides (a replay `HttpClient`, an emulator, or a host's live client) is
+* what the case talks to.
+*
+* @experimental
+*/
+/**
+* The safety policy. `undefined` means the case may run.
+*
+* - `replay` / `in-process` / `emulated`: every case runs.
+* - `live`: `read` runs; `write-reversible` runs only with
+*   `allowWrites: 'reversible'` (else `writes-not-allowed`);
+*   `write-irreversible` runs only when its exact id is in
+*   `allowIrreversible` (else `manual-only`), independent of `allowWrites`.
+*/
+const conformanceSkipReason = (target, testCase) => {
+	if (target.kind !== "live") return;
+	switch (testCase.safety) {
+		case "read": return;
+		case "write-reversible": return target.allowWrites === "reversible" ? void 0 : "writes-not-allowed";
+		case "write-irreversible": return (target.allowIrreversible ?? []).includes(testCase.id) ? void 0 : "manual-only";
+	}
+};
+const staleAge = (date, now, maxAgeDays) => {
+	const age = fixtureAgeDays({ recordedAt: date }, now);
+	if (Number.isNaN(age)) return Option.some(void 0);
+	return age > maxAgeDays ? Option.some(age) : Option.none();
+};
+const withAge = (warning, ageDays) => ageDays === void 0 ? warning : {
+	...warning,
+	ageDays
+};
+/**
+* Warnings for one case. Case-level warnings always apply; fixture-level ones
+* only on non-live targets and only when `fixtures` were supplied.
+*/
+const conformanceCaseWarnings = (testCase, context) => {
+	const maxAgeDays = context.maxFixtureAgeDays ?? 30;
+	const warnings = [];
+	if (testCase.observed === void 0) warnings.push({ kind: "unverified-case" });
+	else {
+		const stale = staleAge(testCase.observed.date, context.now, maxAgeDays);
+		if (Option.isSome(stale)) warnings.push(withAge({ kind: "stale-observation" }, stale.value));
+	}
+	const fixtures = context.fixtures;
+	if (context.target.kind === "live" || fixtures === void 0) return warnings;
+	for (const fixtureId of testCase.fixtures) {
+		const fixture = fixtures.find((candidate) => candidate.id === fixtureId);
+		if (fixture === void 0) {
+			warnings.push({
+				kind: "missing-fixture",
+				fixtureId
+			});
+			continue;
+		}
+		const { evidence, date } = conformanceFixtureEvidence(fixture);
+		if (evidence === "unverified") warnings.push({
+			kind: "unverified-fixture",
+			fixtureId
+		});
+		const stale = date === void 0 ? Option.none() : staleAge(date, context.now, maxAgeDays);
+		if (Option.isSome(stale)) warnings.push(withAge({
+			kind: "stale-fixture",
+			fixtureId
+		}, stale.value));
+	}
+	return warnings;
+};
+const maxFailureMessageLength = 300;
+const reportableTagPattern = /^[A-Za-z][A-Za-z0-9_]*$/;
+const collapseAndCap = (message) => {
+	const compact = message.replace(/\s+/g, " ").trim();
+	return compact.length > maxFailureMessageLength ? `${compact.slice(0, maxFailureMessageLength - 3)}...` : compact;
+};
+/**
+* End index of the balanced `{...}` / `[...]` segment opening at `start` (strings respected);
+* `undefined` when it never closes or closes with the wrong bracket.
+*/
+const balancedSegmentEnd = (text, start) => {
+	const expected = [];
+	let inString = false;
+	for (let index = start; index < text.length; index++) {
+		const char = text[index];
+		if (inString) {
+			if (char === "\\") index++;
+			else if (char === "\"") inString = false;
+			continue;
+		}
+		if (char === "\"") inString = true;
+		else if (char === "{") expected.push("}");
+		else if (char === "[") expected.push("]");
+		else if (char === "}" || char === "]") {
+			if (expected.pop() !== char) return;
+			if (expected.length === 0) return index;
+		}
+	}
+};
+const elideJsonSpans = (text) => {
+	let output = "";
+	let index = 0;
+	while (index < text.length) {
+		const char = text[index];
+		if (char !== "{" && char !== "[") {
+			output += char;
+			index++;
+			continue;
+		}
+		const end = balancedSegmentEnd(text, index);
+		output += "[json]";
+		if (end === void 0) return output;
+		index = end + 1;
+	}
+	return output;
+};
+/**
+* Best-effort sanitizer for failure messages copied into a `ConformanceReport`. Redacts the
+* credential patterns shared with the fixture secret scan (bearer tokens, API-key prefixes, JWTs,
+* private keys, credential field pairs, credential query/form parameters, and credential header
+* lines such as `Cookie:` or `X-Api-Key:` to the end of the line), replaces JSON-looking spans
+* (balanced `{...}` / `[...]`) with `[json]`, collapses whitespace, and caps the length at 300
+* characters. Hosts should still keep secrets out of error messages.
+*/
+const sanitizeConformanceMessage = (message) => collapseAndCap(elideJsonSpans(redactCredentialText(message)));
+const sanitizeMismatchMessage = (message) => collapseAndCap(redactCredentialText(message));
+const stringProperty = (value, key) => {
+	if (!Predicate.hasProperty(value, key)) return;
+	const property = value[key];
+	return Predicate.isString(property) && property.length > 0 ? property : void 0;
+};
+const describeValue = (kind, value) => {
+	const rawTag = stringProperty(value, "_tag");
+	const tag = rawTag !== void 0 && reportableTagPattern.test(rawTag) && redactCredentialText(rawTag) === rawTag ? rawTag : void 0;
+	const rawMessage = stringProperty(value, "message") ?? (Predicate.isString(value) && value.length > 0 ? value : void 0);
+	const failure = {
+		kind,
+		message: rawMessage === void 0 ? tag ?? (kind === "defect" ? "unexpected defect" : "case failed") : value instanceof ConformanceMismatch ? sanitizeMismatchMessage(rawMessage) : sanitizeConformanceMessage(rawMessage)
+	};
+	return tag === void 0 ? failure : {
+		...failure,
+		tag
+	};
+};
+const describeCause = (cause) => {
+	const error = Cause.findErrorOption(cause);
+	if (Option.isSome(error)) return describeValue("failure", error.value);
+	return describeValue("defect", Cause.squash(cause));
+};
+const summarize = (results) => {
+	const counts = {
+		passed: 0,
+		failed: 0,
+		skipped: 0
+	};
+	for (const result of results) counts[result.status] += 1;
+	return counts;
+};
+const identityResult = (result) => result;
+const reportTarget = (target) => target.kind === "live" ? {
+	kind: target.kind,
+	account: target.account
+} : { kind: target.kind };
+function runConformance(cases, options) {
+	return Effect.gen(function* () {
+		const now = options.now ?? new Date(yield* Clock.currentTimeMillis);
+		const warningContext = {
+			target: options.target,
+			now,
+			fixtures: options.fixtures,
+			maxFixtureAgeDays: options.maxFixtureAgeDays
+		};
+		const runCase = (testCase) => Effect.gen(function* () {
+			const base = {
+				id: testCase.id,
+				safety: testCase.safety,
+				warnings: conformanceCaseWarnings(testCase, warningContext)
+			};
+			const skipReason = conformanceSkipReason(options.target, testCase);
+			if (skipReason !== void 0) return identityResult({
+				...base,
+				status: "skipped",
+				skipReason,
+				durationMs: 0
+			});
+			const started = yield* Clock.currentTimeMillis;
+			const exit = yield* Effect.suspend(() => testCase.run.pipe(Effect.provide(options.layer(testCase), { local: true }))).pipe(Effect.exit);
+			const durationMs = (yield* Clock.currentTimeMillis) - started;
+			if (Exit.isSuccess(exit)) return identityResult({
+				...base,
+				status: "passed",
+				durationMs
+			});
+			if (Cause.hasInterruptsOnly(exit.cause)) return yield* Effect.interrupt;
+			return identityResult({
+				...base,
+				status: "failed",
+				failure: describeCause(exit.cause),
+				durationMs
+			});
+		});
+		const results = yield* Effect.forEach(cases, runCase, { concurrency: options.concurrency ?? 1 });
+		return {
+			target: reportTarget(options.target),
+			startedAt: now.toISOString(),
+			results,
+			summary: summarize(results)
+		};
+	});
+}
+/** True when any case failed. Skipped cases never fail a report. */
+const conformanceReportFailed = (report) => report.summary.failed > 0;
+const statusLabel = {
+	passed: "PASS",
+	failed: "FAIL",
+	skipped: "SKIP"
+};
+const formatAge = (ageDays) => ageDays === void 0 ? "(unreadable date)" : `(${ageDays}d)`;
+const formatWarning = (warning) => {
+	switch (warning.kind) {
+		case "unverified-case": return warning.kind;
+		case "stale-observation": return `${warning.kind}${formatAge(warning.ageDays)}`;
+		case "unverified-fixture":
+		case "missing-fixture": return `${warning.kind}:${warning.fixtureId}`;
+		case "stale-fixture": return `${warning.kind}:${warning.fixtureId}${formatAge(warning.ageDays)}`;
+	}
+};
+const formatDetail = (result) => {
+	if (result.skipReason !== void 0) return result.skipReason;
+	if (result.failure === void 0) return;
+	return `${result.failure.kind === "defect" ? "defect " : ""}${result.failure.tag === void 0 ? "" : `${result.failure.tag}: `}${result.failure.message}`;
+};
+/**
+* Compact plain text (no colors): one line per case with status, id, safety,
+* skip reason or failure message, and warnings, then a summary line.
+*/
+const formatConformanceReport = (report) => {
+	const lines = report.results.map((result) => {
+		const detail = formatDetail(result);
+		const warnings = result.warnings.length === 0 ? void 0 : `warnings: ${result.warnings.map(formatWarning).join(", ")}`;
+		return [
+			statusLabel[result.status],
+			result.id,
+			`[${result.safety}]`,
+			detail,
+			warnings
+		].filter(Predicate.isNotUndefined).join("  ");
+	});
+	const target = report.target.account === void 0 ? report.target.kind : `${report.target.kind} (account ${report.target.account})`;
+	const { passed, failed, skipped } = report.summary;
+	return [...lines, `${passed} passed, ${failed} failed, ${skipped} skipped; target ${target}; started ${report.startedAt}`].join("\n");
+};
+//#endregion
+export { conformanceCaseWarnings, conformanceReportFailed, conformanceSkipReason, formatConformanceReport, runConformance, sanitizeConformanceMessage };
+
+//# sourceMappingURL=runner.mjs.map

package/dist/runner.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.mjs","names":[],"sources":["../src/runner.ts"],"sourcesContent":["/**\n * Conformance runner: decides which cases may run against a target (safety\n * policy), runs each allowed case in isolation with freshly built layers, and\n * produces a plain-data report.\n *\n * The runner never performs network I/O itself; whatever the per-case layer\n * provides (a replay `HttpClient`, an emulator, or a host's live client) is\n * what the case talks to.\n *\n * @experimental\n */\nimport { Cause, Clock, Effect, Exit, Option, Predicate, type Layer } from 'effect'\nimport { ConformanceMismatch, type ConformanceCase, type ConformanceSafety } from './case.ts'\nimport { conformanceFixtureEvidence, fixtureAgeDays, type ConformanceFixture } from './fixture.ts'\nimport { redactCredentialText } from './wire-internal.ts'\n\n/**\n * Where cases run. `replay`, `in-process`, and `emulated` never touch a real\n * account, so every case runs. `live` talks to a real practice account and is\n * gated by the safety policy (see `conformanceSkipReason`).\n */\nexport type ConformanceTarget =\n  | { readonly kind: 'replay' | 'in-process' | 'emulated' }\n  | {\n      readonly kind: 'live'\n      /** Synthetic, non-identifying account label (for example `practice`). */\n      readonly account: string\n      /** `reversible` lets `write-reversible` cases run. Default `none`. */\n      readonly allowWrites?: 'none' | 'reversible'\n      /** Exact ids of `write-irreversible` cases a person explicitly started. */\n      readonly allowIrreversible?: ReadonlyArray<string>\n    }\n\nexport type ConformanceTargetKind = ConformanceTarget['kind']\n\nexport type ConformanceSkipReason = 'writes-not-allowed' | 'manual-only'\n\n/**\n * The safety policy. `undefined` means the case may run.\n *\n * - `replay` / `in-process` / `emulated`: every case runs.\n * - `live`: `read` runs; `write-reversible` runs only with\n *   `allowWrites: 'reversible'` (else `writes-not-allowed`);\n *   `write-irreversible` runs only when its exact id is in\n *   `allowIrreversible` (else `manual-only`), independent of `allowWrites`.\n */\nexport const conformanceSkipReason = (\n  target: ConformanceTarget,\n  testCase: { readonly id: string; readonly safety: ConformanceSafety }\n): ConformanceSkipReason | undefined => {\n  if (target.kind !== 'live') {\n    return undefined\n  }\n\n  switch (testCase.safety) {\n    case 'read':\n      return undefined\n    case 'write-reversible':\n      return target.allowWrites === 'reversible' ? undefined : 'writes-not-allowed'\n    case 'write-irreversible':\n      return (target.allowIrreversible ?? []).includes(testCase.id) ? undefined : 'manual-only'\n  }\n}\n\n/** Non-fatal findings attached to a case result. */\nexport type ConformanceWarning =\n  /** The case has no `observed`: its claim was never watched against the real service. */\n  | { readonly kind: 'unverified-case' }\n  /** `observed.date` is older than the max age (`ageDays` absent when unreadable). */\n  | { readonly kind: 'stale-observation'; readonly ageDays?: number }\n  /** A referenced fixture is a synthetic placeholder (`evidence: 'unverified'`, or a `PortFixture` without `observed`). */\n  | { readonly kind: 'unverified-fixture'; readonly fixtureId: string }\n  /** A referenced fixture is older than the max age (`ageDays` absent when unreadable). */\n  | { readonly kind: 'stale-fixture'; readonly fixtureId: string; readonly ageDays?: number }\n  /** A referenced fixture id is not among the supplied fixtures. */\n  | { readonly kind: 'missing-fixture'; readonly fixtureId: string }\n\nexport type ConformanceWarningKind = ConformanceWarning['kind']\n\n/**\n * Sanitized failure. `message` is a `ConformanceMismatch`'s case-authored\n * message (credential patterns redacted) or, for every other failure, layer\n * failure, and defect, the error's own message passed through\n * `sanitizeConformanceMessage` (credential patterns and header lines redacted, JSON\n * spans elided, whitespace collapsed, length capped). `tag` is the error's\n * `_tag` only when it is identifier-like. Request bodies, headers, and\n * `ConformanceMismatch` `expected`/`actual` details are never copied.\n */\nexport type ConformanceFailure = {\n  /** `failure`: typed error (including layer build errors); `defect`: unexpected die. */\n  readonly kind: 'failure' | 'defect'\n  readonly tag?: string\n  readonly message: string\n}\n\nexport type ConformanceCaseStatus = 'passed' | 'failed' | 'skipped'\n\nexport type ConformanceCaseResult = {\n  readonly id: string\n  readonly safety: ConformanceSafety\n  readonly status: ConformanceCaseStatus\n  readonly skipReason?: ConformanceSkipReason\n  readonly failure?: ConformanceFailure\n  readonly durationMs: number\n  readonly warnings: ReadonlyArray<ConformanceWarning>\n}\n\nexport type ConformanceReport = {\n  readonly target: { readonly kind: ConformanceTargetKind; readonly account?: string }\n  /** ISO timestamp of the run start. */\n  readonly startedAt: string\n  readonly results: ReadonlyArray<ConformanceCaseResult>\n  readonly summary: {\n    readonly passed: number\n    readonly failed: number\n    readonly skipped: number\n  }\n}\n\n/** What a case (or a union of cases) needs from its layer. */\nexport type ConformanceCaseRequirements<C> = C extends {\n  readonly run: Effect.Effect<void, unknown, infer R>\n}\n  ? R\n  : never\n\ntype RunSettings = {\n  readonly target: ConformanceTarget\n  /**\n   * Fixtures to check referenced ids against (evidence, staleness, missing ids): HTTP\n   * `WireFixture`s and `PortFixture`s alike.\n   */\n  readonly fixtures?: ReadonlyArray<ConformanceFixture>\n  /** Reference time for staleness and `startedAt`. Defaults to the Effect `Clock`. */\n  readonly now?: Date\n  /** Fixtures and observations older than this many whole days are stale. Default 30. */\n  readonly maxFixtureAgeDays?: number\n  /** Cases run in parallel up to this limit. Default 1: live accounts are shared. */\n  readonly concurrency?: number\n}\n\n/**\n * Options for `runConformance` over cases of type `C` (a union when the cases\n * differ).\n *\n * `layer` is called once per case that runs and must provide everything that\n * case needs (`ConformanceCaseRequirements<C>`; providing more is fine). It is\n * called and built inside the case's failure boundary, with a fresh memo map\n * in its own scope, so state the layer allocates when it is built (replay\n * consumption, ledgers, emulator state) never leaks between cases, even when\n * the factory returns the same `Layer` value. Services captured in a shared\n * value (for example one `Layer.succeed(service, instance)`) or supplied by\n * the caller's environment are not rebuilt and stay shared. Build failures\n * (`LE`) and a throwing factory are reported as failed cases. `LR` is\n * whatever the layers still need from the caller (for example a live\n * `HttpClient`) and becomes the requirement of the whole run.\n */\nexport type ConformanceRunOptions<C, LE = never, LR = never> = RunSettings & {\n  readonly layer: (testCase: C) => Layer.Layer<ConformanceCaseRequirements<C>, LE, LR>\n}\n\nconst staleAge = (\n  date: string,\n  now: Date,\n  maxAgeDays: number\n): Option.Option<number | undefined> => {\n  const age = fixtureAgeDays({ recordedAt: date }, now)\n\n  if (Number.isNaN(age)) {\n    return Option.some(undefined)\n  }\n\n  return age > maxAgeDays ? Option.some(age) : Option.none()\n}\n\nconst withAge = <W extends { readonly kind: string }>(\n  warning: W,\n  ageDays: number | undefined\n): W | (W & { readonly ageDays: number }) =>\n  ageDays === undefined ? warning : { ...warning, ageDays }\n\n/**\n * Warnings for one case. Case-level warnings always apply; fixture-level ones\n * only on non-live targets and only when `fixtures` were supplied.\n */\nexport const conformanceCaseWarnings = (\n  testCase: Pick<ConformanceCase<unknown, unknown>, 'observed' | 'fixtures'>,\n  context: {\n    readonly target: ConformanceTarget\n    readonly now: Date\n    readonly fixtures?: ReadonlyArray<ConformanceFixture> | undefined\n    readonly maxFixtureAgeDays?: number | undefined\n  }\n): ReadonlyArray<ConformanceWarning> => {\n  const maxAgeDays = context.maxFixtureAgeDays ?? 30\n  const warnings: Array<ConformanceWarning> = []\n\n  if (testCase.observed === undefined) {\n    warnings.push({ kind: 'unverified-case' })\n  } else {\n    const stale = staleAge(testCase.observed.date, context.now, maxAgeDays)\n\n    if (Option.isSome(stale)) {\n      warnings.push(withAge({ kind: 'stale-observation' }, stale.value))\n    }\n  }\n\n  const fixtures = context.fixtures\n\n  if (context.target.kind === 'live' || fixtures === undefined) {\n    return warnings\n  }\n\n  for (const fixtureId of testCase.fixtures) {\n    const fixture = fixtures.find(candidate => candidate.id === fixtureId)\n\n    if (fixture === undefined) {\n      warnings.push({ kind: 'missing-fixture', fixtureId })\n      continue\n    }\n\n    const { evidence, date } = conformanceFixtureEvidence(fixture)\n\n    if (evidence === 'unverified') {\n      warnings.push({ kind: 'unverified-fixture', fixtureId })\n    }\n\n    // A synthetic `PortFixture` carries no date: it is unverified, not stale.\n    const stale = date === undefined ? Option.none() : staleAge(date, context.now, maxAgeDays)\n\n    if (Option.isSome(stale)) {\n      warnings.push(withAge({ kind: 'stale-fixture', fixtureId }, stale.value))\n    }\n  }\n\n  return warnings\n}\n\nconst maxFailureMessageLength = 300\n\n// Only identifier-like tags are reported; anything else (spaces, punctuation, payload text) is\n// dropped.\nconst reportableTagPattern = /^[A-Za-z][A-Za-z0-9_]*$/\n\nconst collapseAndCap = (message: string): string => {\n  const compact = message.replace(/\\s+/g, ' ').trim()\n\n  return compact.length > maxFailureMessageLength\n    ? `${compact.slice(0, maxFailureMessageLength - 3)}...`\n    : compact\n}\n\n/**\n * End index of the balanced `{...}` / `[...]` segment opening at `start` (strings respected);\n * `undefined` when it never closes or closes with the wrong bracket.\n */\nconst balancedSegmentEnd = (text: string, start: number): number | undefined => {\n  const expected: Array<string> = []\n  let inString = false\n\n  for (let index = start; index < text.length; index++) {\n    const char = text[index]\n\n    if (inString) {\n      if (char === '\\\\') {\n        index++\n      } else if (char === '\"') {\n        inString = false\n      }\n\n      continue\n    }\n\n    if (char === '\"') {\n      inString = true\n    } else if (char === '{') {\n      expected.push('}')\n    } else if (char === '[') {\n      expected.push(']')\n    } else if (char === '}' || char === ']') {\n      if (expected.pop() !== char) {\n        return undefined\n      }\n\n      if (expected.length === 0) {\n        return index\n      }\n    }\n  }\n\n  return undefined\n}\n\n// Replace every balanced `{...}` / `[...]` segment with `[json]`. An unbalanced opening bracket\n// (for example a truncated body) elides the rest of the message.\nconst elideJsonSpans = (text: string): string => {\n  let output = ''\n  let index = 0\n\n  while (index < text.length) {\n    const char = text[index]\n\n    if (char !== '{' && char !== '[') {\n      output += char\n      index++\n      continue\n    }\n\n    const end = balancedSegmentEnd(text, index)\n    output += '[json]'\n\n    if (end === undefined) {\n      return output\n    }\n\n    index = end + 1\n  }\n\n  return output\n}\n\n/**\n * Best-effort sanitizer for failure messages copied into a `ConformanceReport`. Redacts the\n * credential patterns shared with the fixture secret scan (bearer tokens, API-key prefixes, JWTs,\n * private keys, credential field pairs, credential query/form parameters, and credential header\n * lines such as `Cookie:` or `X-Api-Key:` to the end of the line), replaces JSON-looking spans\n * (balanced `{...}` / `[...]`) with `[json]`, collapses whitespace, and caps the length at 300\n * characters. Hosts should still keep secrets out of error messages.\n */\nexport const sanitizeConformanceMessage = (message: string): string =>\n  collapseAndCap(elideJsonSpans(redactCredentialText(message)))\n\n// A `ConformanceMismatch` message is written by the case author: keep it readable (no JSON\n// elision), but still redact credential patterns.\nconst sanitizeMismatchMessage = (message: string): string =>\n  collapseAndCap(redactCredentialText(message))\n\nconst stringProperty = (value: unknown, key: string): string | undefined => {\n  if (!Predicate.hasProperty(value, key)) {\n    return undefined\n  }\n\n  const property = value[key]\n\n  return Predicate.isString(property) && property.length > 0 ? property : undefined\n}\n\nconst describeValue = (kind: ConformanceFailure['kind'], value: unknown): ConformanceFailure => {\n  const rawTag = stringProperty(value, '_tag')\n\n  // Identifier-like and not credential-shaped (e.g. a `vck_...` value is never echoed).\n  const tag =\n    rawTag !== undefined &&\n    reportableTagPattern.test(rawTag) &&\n    redactCredentialText(rawTag) === rawTag\n      ? rawTag\n      : undefined\n\n  const rawMessage =\n    stringProperty(value, 'message') ??\n    (Predicate.isString(value) && value.length > 0 ? value : undefined)\n\n  const message =\n    rawMessage === undefined\n      ? (tag ?? (kind === 'defect' ? 'unexpected defect' : 'case failed'))\n      : value instanceof ConformanceMismatch\n        ? sanitizeMismatchMessage(rawMessage)\n        : sanitizeConformanceMessage(rawMessage)\n\n  const failure = { kind, message }\n\n  return tag === undefined ? failure : { ...failure, tag }\n}\n\nconst describeCause = <E>(cause: Cause.Cause<E>): ConformanceFailure => {\n  const error = Cause.findErrorOption(cause)\n\n  if (Option.isSome(error)) {\n    return describeValue('failure', error.value)\n  }\n\n  return describeValue('defect', Cause.squash(cause))\n}\n\ntype Counts = { passed: number; failed: number; skipped: number }\n\nconst summarize = (results: ReadonlyArray<ConformanceCaseResult>): Counts => {\n  const counts: Counts = { passed: 0, failed: 0, skipped: 0 }\n\n  for (const result of results) {\n    counts[result.status] += 1\n  }\n\n  return counts\n}\n\n// Pins object literals to the result type so `status` stays a literal.\nconst identityResult = (result: ConformanceCaseResult): ConformanceCaseResult => result\n\nconst reportTarget = (target: ConformanceTarget): ConformanceReport['target'] =>\n  target.kind === 'live' ? { kind: target.kind, account: target.account } : { kind: target.kind }\n\n/**\n * Run cases against a target and report. Skipped cases never build their\n * layer. Each running case gets a fresh layer and runs under `Effect.exit`:\n * failures, layer build failures, defects, and a throwing `layer` factory\n * become `failed` results and the run continues. Interruption is not\n * captured: interrupting the run (or a case interrupting itself) interrupts\n * the whole run.\n *\n * `C` is inferred as the union of the given case types, so cases with\n * different errors and requirements can share one run without annotations.\n */\nexport function runConformance<C extends ConformanceCase<unknown, unknown>, LE = never, LR = never>(\n  cases: ReadonlyArray<C>,\n  options: ConformanceRunOptions<C, LE, LR>\n): Effect.Effect<ConformanceReport, never, LR>\n// Implementation signature: one case type whose `run` needs exactly `R`, which\n// is what the public signature's `ConformanceCaseRequirements<C>` denotes.\nexport function runConformance<E, R, LE, LR>(\n  cases: ReadonlyArray<ConformanceCase<E, R>>,\n  options: RunSettings & {\n    readonly layer: (testCase: ConformanceCase<E, R>) => Layer.Layer<R, LE, LR>\n  }\n): Effect.Effect<ConformanceReport, never, LR> {\n  return Effect.gen(function* () {\n    const now = options.now ?? new Date(yield* Clock.currentTimeMillis)\n\n    const warningContext = {\n      target: options.target,\n      now,\n      fixtures: options.fixtures,\n      maxFixtureAgeDays: options.maxFixtureAgeDays\n    }\n\n    const runCase = (testCase: ConformanceCase<E, R>) =>\n      Effect.gen(function* () {\n        const base = {\n          id: testCase.id,\n          safety: testCase.safety,\n          warnings: conformanceCaseWarnings(testCase, warningContext)\n        }\n\n        const skipReason = conformanceSkipReason(options.target, testCase)\n\n        if (skipReason !== undefined) {\n          return identityResult({ ...base, status: 'skipped', skipReason, durationMs: 0 })\n        }\n\n        const started = yield* Clock.currentTimeMillis\n\n        // The factory runs inside the exit boundary: a throwing factory fails this case only.\n        const exit = yield* Effect.suspend(() =>\n          testCase.run.pipe(Effect.provide(options.layer(testCase), { local: true }))\n        ).pipe(Effect.exit)\n\n        const durationMs = (yield* Clock.currentTimeMillis) - started\n\n        if (Exit.isSuccess(exit)) {\n          return identityResult({ ...base, status: 'passed', durationMs })\n        }\n\n        if (Cause.hasInterruptsOnly(exit.cause)) {\n          return yield* Effect.interrupt\n        }\n\n        return identityResult({\n          ...base,\n          status: 'failed',\n          failure: describeCause(exit.cause),\n          durationMs\n        })\n      })\n\n    const results = yield* Effect.forEach(cases, runCase, {\n      concurrency: options.concurrency ?? 1\n    })\n\n    return {\n      target: reportTarget(options.target),\n      startedAt: now.toISOString(),\n      results,\n      summary: summarize(results)\n    }\n  })\n}\n\n/** True when any case failed. Skipped cases never fail a report. */\nexport const conformanceReportFailed = (report: ConformanceReport): boolean =>\n  report.summary.failed > 0\n\nconst statusLabel: Record<ConformanceCaseStatus, string> = {\n  passed: 'PASS',\n  failed: 'FAIL',\n  skipped: 'SKIP'\n}\n\nconst formatAge = (ageDays: number | undefined): string =>\n  ageDays === undefined ? '(unreadable date)' : `(${ageDays}d)`\n\nconst formatWarning = (warning: ConformanceWarning): string => {\n  switch (warning.kind) {\n    case 'unverified-case':\n      return warning.kind\n    case 'stale-observation':\n      return `${warning.kind}${formatAge(warning.ageDays)}`\n    case 'unverified-fixture':\n    case 'missing-fixture':\n      return `${warning.kind}:${warning.fixtureId}`\n    case 'stale-fixture':\n      return `${warning.kind}:${warning.fixtureId}${formatAge(warning.ageDays)}`\n  }\n}\n\nconst formatDetail = (result: ConformanceCaseResult): string | undefined => {\n  if (result.skipReason !== undefined) {\n    return result.skipReason\n  }\n\n  if (result.failure === undefined) {\n    return undefined\n  }\n\n  const prefix = result.failure.kind === 'defect' ? 'defect ' : ''\n  const tag = result.failure.tag === undefined ? '' : `${result.failure.tag}: `\n\n  return `${prefix}${tag}${result.failure.message}`\n}\n\n/**\n * Compact plain text (no colors): one line per case with status, id, safety,\n * skip reason or failure message, and warnings, then a summary line.\n */\nexport const formatConformanceReport = (report: ConformanceReport): string => {\n  const lines = report.results.map(result => {\n    const detail = formatDetail(result)\n\n    const warnings =\n      result.warnings.length === 0\n        ? undefined\n        : `warnings: ${result.warnings.map(formatWarning).join(', ')}`\n\n    return [statusLabel[result.status], result.id, `[${result.safety}]`, detail, warnings]\n      .filter(Predicate.isNotUndefined)\n      .join('  ')\n  })\n\n  const target =\n    report.target.account === undefined\n      ? report.target.kind\n      : `${report.target.kind} (account ${report.target.account})`\n\n  const { passed, failed, skipped } = report.summary\n\n  return [\n    ...lines,\n    `${passed} passed, ${failed} failed, ${skipped} skipped; target ${target}; started ${report.startedAt}`\n  ].join('\\n')\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA8CA,MAAa,yBACX,QACA,aACsC;CACtC,IAAI,OAAO,SAAS,QAClB;CAGF,QAAQ,SAAS,QAAjB;EACE,KAAK,QACH;EACF,KAAK,oBACH,OAAO,OAAO,gBAAgB,eAAe,KAAA,IAAY;EAC3D,KAAK,sBACH,QAAQ,OAAO,qBAAqB,CAAC,GAAG,SAAS,SAAS,EAAE,IAAI,KAAA,IAAY;CAChF;AACF;AAmGA,MAAM,YACJ,MACA,KACA,eACsC;CACtC,MAAM,MAAM,eAAe,EAAE,YAAY,KAAK,GAAG,GAAG;CAEpD,IAAI,OAAO,MAAM,GAAG,GAClB,OAAO,OAAO,KAAK,KAAA,CAAS;CAG9B,OAAO,MAAM,aAAa,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK;AAC3D;AAEA,MAAM,WACJ,SACA,YAEA,YAAY,KAAA,IAAY,UAAU;CAAE,GAAG;CAAS;AAAQ;;;;;AAM1D,MAAa,2BACX,UACA,YAMsC;CACtC,MAAM,aAAa,QAAQ,qBAAqB;CAChD,MAAM,WAAsC,CAAC;CAE7C,IAAI,SAAS,aAAa,KAAA,GACxB,SAAS,KAAK,EAAE,MAAM,kBAAkB,CAAC;MACpC;EACL,MAAM,QAAQ,SAAS,SAAS,SAAS,MAAM,QAAQ,KAAK,UAAU;EAEtE,IAAI,OAAO,OAAO,KAAK,GACrB,SAAS,KAAK,QAAQ,EAAE,MAAM,oBAAoB,GAAG,MAAM,KAAK,CAAC;CAErE;CAEA,MAAM,WAAW,QAAQ;CAEzB,IAAI,QAAQ,OAAO,SAAS,UAAU,aAAa,KAAA,GACjD,OAAO;CAGT,KAAK,MAAM,aAAa,SAAS,UAAU;EACzC,MAAM,UAAU,SAAS,MAAK,cAAa,UAAU,OAAO,SAAS;EAErE,IAAI,YAAY,KAAA,GAAW;GACzB,SAAS,KAAK;IAAE,MAAM;IAAmB;GAAU,CAAC;GACpD;EACF;EAEA,MAAM,EAAE,UAAU,SAAS,2BAA2B,OAAO;EAE7D,IAAI,aAAa,cACf,SAAS,KAAK;GAAE,MAAM;GAAsB;EAAU,CAAC;EAIzD,MAAM,QAAQ,SAAS,KAAA,IAAY,OAAO,KAAK,IAAI,SAAS,MAAM,QAAQ,KAAK,UAAU;EAEzF,IAAI,OAAO,OAAO,KAAK,GACrB,SAAS,KAAK,QAAQ;GAAE,MAAM;GAAiB;EAAU,GAAG,MAAM,KAAK,CAAC;CAE5E;CAEA,OAAO;AACT;AAEA,MAAM,0BAA0B;AAIhC,MAAM,uBAAuB;AAE7B,MAAM,kBAAkB,YAA4B;CAClD,MAAM,UAAU,QAAQ,QAAQ,QAAQ,GAAG,EAAE,KAAK;CAElD,OAAO,QAAQ,SAAS,0BACpB,GAAG,QAAQ,MAAM,GAAG,0BAA0B,CAAC,EAAE,OACjD;AACN;;;;;AAMA,MAAM,sBAAsB,MAAc,UAAsC;CAC9E,MAAM,WAA0B,CAAC;CACjC,IAAI,WAAW;CAEf,KAAK,IAAI,QAAQ,OAAO,QAAQ,KAAK,QAAQ,SAAS;EACpD,MAAM,OAAO,KAAK;EAElB,IAAI,UAAU;GACZ,IAAI,SAAS,MACX;QACK,IAAI,SAAS,MAClB,WAAW;GAGb;EACF;EAEA,IAAI,SAAS,MACX,WAAW;OACN,IAAI,SAAS,KAClB,SAAS,KAAK,GAAG;OACZ,IAAI,SAAS,KAClB,SAAS,KAAK,GAAG;OACZ,IAAI,SAAS,OAAO,SAAS,KAAK;GACvC,IAAI,SAAS,IAAI,MAAM,MACrB;GAGF,IAAI,SAAS,WAAW,GACtB,OAAO;EAEX;CACF;AAGF;AAIA,MAAM,kBAAkB,SAAyB;CAC/C,IAAI,SAAS;CACb,IAAI,QAAQ;CAEZ,OAAO,QAAQ,KAAK,QAAQ;EAC1B,MAAM,OAAO,KAAK;EAElB,IAAI,SAAS,OAAO,SAAS,KAAK;GAChC,UAAU;GACV;GACA;EACF;EAEA,MAAM,MAAM,mBAAmB,MAAM,KAAK;EAC1C,UAAU;EAEV,IAAI,QAAQ,KAAA,GACV,OAAO;EAGT,QAAQ,MAAM;CAChB;CAEA,OAAO;AACT;;;;;;;;;AAUA,MAAa,8BAA8B,YACzC,eAAe,eAAe,qBAAqB,OAAO,CAAC,CAAC;AAI9D,MAAM,2BAA2B,YAC/B,eAAe,qBAAqB,OAAO,CAAC;AAE9C,MAAM,kBAAkB,OAAgB,QAAoC;CAC1E,IAAI,CAAC,UAAU,YAAY,OAAO,GAAG,GACnC;CAGF,MAAM,WAAW,MAAM;CAEvB,OAAO,UAAU,SAAS,QAAQ,KAAK,SAAS,SAAS,IAAI,WAAW,KAAA;AAC1E;AAEA,MAAM,iBAAiB,MAAkC,UAAuC;CAC9F,MAAM,SAAS,eAAe,OAAO,MAAM;CAG3C,MAAM,MACJ,WAAW,KAAA,KACX,qBAAqB,KAAK,MAAM,KAChC,qBAAqB,MAAM,MAAM,SAC7B,SACA,KAAA;CAEN,MAAM,aACJ,eAAe,OAAO,SAAS,MAC9B,UAAU,SAAS,KAAK,KAAK,MAAM,SAAS,IAAI,QAAQ,KAAA;CAS3D,MAAM,UAAU;EAAE;EAAM,SANtB,eAAe,KAAA,IACV,QAAQ,SAAS,WAAW,sBAAsB,iBACnD,iBAAiB,sBACf,wBAAwB,UAAU,IAClC,2BAA2B,UAAU;CAEb;CAEhC,OAAO,QAAQ,KAAA,IAAY,UAAU;EAAE,GAAG;EAAS;CAAI;AACzD;AAEA,MAAM,iBAAoB,UAA8C;CACtE,MAAM,QAAQ,MAAM,gBAAgB,KAAK;CAEzC,IAAI,OAAO,OAAO,KAAK,GACrB,OAAO,cAAc,WAAW,MAAM,KAAK;CAG7C,OAAO,cAAc,UAAU,MAAM,OAAO,KAAK,CAAC;AACpD;AAIA,MAAM,aAAa,YAA0D;CAC3E,MAAM,SAAiB;EAAE,QAAQ;EAAG,QAAQ;EAAG,SAAS;CAAE;CAE1D,KAAK,MAAM,UAAU,SACnB,OAAO,OAAO,WAAW;CAG3B,OAAO;AACT;AAGA,MAAM,kBAAkB,WAAyD;AAEjF,MAAM,gBAAgB,WACpB,OAAO,SAAS,SAAS;CAAE,MAAM,OAAO;CAAM,SAAS,OAAO;AAAQ,IAAI,EAAE,MAAM,OAAO,KAAK;AAmBhG,SAAgB,eACd,OACA,SAG6C;CAC7C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,MAAM,QAAQ,OAAO,IAAI,KAAK,OAAO,MAAM,iBAAiB;EAElE,MAAM,iBAAiB;GACrB,QAAQ,QAAQ;GAChB;GACA,UAAU,QAAQ;GAClB,mBAAmB,QAAQ;EAC7B;EAEA,MAAM,WAAW,aACf,OAAO,IAAI,aAAa;GACtB,MAAM,OAAO;IACX,IAAI,SAAS;IACb,QAAQ,SAAS;IACjB,UAAU,wBAAwB,UAAU,cAAc;GAC5D;GAEA,MAAM,aAAa,sBAAsB,QAAQ,QAAQ,QAAQ;GAEjE,IAAI,eAAe,KAAA,GACjB,OAAO,eAAe;IAAE,GAAG;IAAM,QAAQ;IAAW;IAAY,YAAY;GAAE,CAAC;GAGjF,MAAM,UAAU,OAAO,MAAM;GAG7B,MAAM,OAAO,OAAO,OAAO,cACzB,SAAS,IAAI,KAAK,OAAO,QAAQ,QAAQ,MAAM,QAAQ,GAAG,EAAE,OAAO,KAAK,CAAC,CAAC,CAC5E,EAAE,KAAK,OAAO,IAAI;GAElB,MAAM,cAAc,OAAO,MAAM,qBAAqB;GAEtD,IAAI,KAAK,UAAU,IAAI,GACrB,OAAO,eAAe;IAAE,GAAG;IAAM,QAAQ;IAAU;GAAW,CAAC;GAGjE,IAAI,MAAM,kBAAkB,KAAK,KAAK,GACpC,OAAO,OAAO,OAAO;GAGvB,OAAO,eAAe;IACpB,GAAG;IACH,QAAQ;IACR,SAAS,cAAc,KAAK,KAAK;IACjC;GACF,CAAC;EACH,CAAC;EAEH,MAAM,UAAU,OAAO,OAAO,QAAQ,OAAO,SAAS,EACpD,aAAa,QAAQ,eAAe,EACtC,CAAC;EAED,OAAO;GACL,QAAQ,aAAa,QAAQ,MAAM;GACnC,WAAW,IAAI,YAAY;GAC3B;GACA,SAAS,UAAU,OAAO;EAC5B;CACF,CAAC;AACH;;AAGA,MAAa,2BAA2B,WACtC,OAAO,QAAQ,SAAS;AAE1B,MAAM,cAAqD;CACzD,QAAQ;CACR,QAAQ;CACR,SAAS;AACX;AAEA,MAAM,aAAa,YACjB,YAAY,KAAA,IAAY,sBAAsB,IAAI,QAAQ;AAE5D,MAAM,iBAAiB,YAAwC;CAC7D,QAAQ,QAAQ,MAAhB;EACE,KAAK,mBACH,OAAO,QAAQ;EACjB,KAAK,qBACH,OAAO,GAAG,QAAQ,OAAO,UAAU,QAAQ,OAAO;EACpD,KAAK;EACL,KAAK,mBACH,OAAO,GAAG,QAAQ,KAAK,GAAG,QAAQ;EACpC,KAAK,iBACH,OAAO,GAAG,QAAQ,KAAK,GAAG,QAAQ,YAAY,UAAU,QAAQ,OAAO;CAC3E;AACF;AAEA,MAAM,gBAAgB,WAAsD;CAC1E,IAAI,OAAO,eAAe,KAAA,GACxB,OAAO,OAAO;CAGhB,IAAI,OAAO,YAAY,KAAA,GACrB;CAMF,OAAO,GAHQ,OAAO,QAAQ,SAAS,WAAW,YAAY,KAClD,OAAO,QAAQ,QAAQ,KAAA,IAAY,KAAK,GAAG,OAAO,QAAQ,IAAI,MAEjD,OAAO,QAAQ;AAC1C;;;;;AAMA,MAAa,2BAA2B,WAAsC;CAC5E,MAAM,QAAQ,OAAO,QAAQ,KAAI,WAAU;EACzC,MAAM,SAAS,aAAa,MAAM;EAElC,MAAM,WACJ,OAAO,SAAS,WAAW,IACvB,KAAA,IACA,aAAa,OAAO,SAAS,IAAI,aAAa,EAAE,KAAK,IAAI;EAE/D,OAAO;GAAC,YAAY,OAAO;GAAS,OAAO;GAAI,IAAI,OAAO,OAAO;GAAI;GAAQ;EAAQ,EAClF,OAAO,UAAU,cAAc,EAC/B,KAAK,IAAI;CACd,CAAC;CAED,MAAM,SACJ,OAAO,OAAO,YAAY,KAAA,IACtB,OAAO,OAAO,OACd,GAAG,OAAO,OAAO,KAAK,YAAY,OAAO,OAAO,QAAQ;CAE9D,MAAM,EAAE,QAAQ,QAAQ,YAAY,OAAO;CAE3C,OAAO,CACL,GAAG,OACH,GAAG,OAAO,WAAW,OAAO,WAAW,QAAQ,mBAAmB,OAAO,YAAY,OAAO,WAC9F,EAAE,KAAK,IAAI;AACb"}

package/dist/wire-internal.d.mts

@@ -0,0 +1,90 @@
+import { Effect, Option } from "effect";
+import * as Schema from "effect/Schema";
+import { HttpClientRequest } from "effect/unstable/http";
+
+//#region src/wire-internal.d.ts
+/**
+ * True for header names that carry credentials or session state. Used by the
+ * fixture secret scan, recorder drop rules, and ledger redaction.
+ */
+declare const isCredentialHeaderName: (name: string) => boolean;
+declare const redactedHeaderValue = "<redacted>";
+/** `Bearer <token>` with a token-shaped value. */
+declare const bearerPattern: RegExp;
+/** Common API-key prefixes, JSON Web Tokens, and PEM private keys. */
+declare const apiKeyPatterns: ReadonlyArray<RegExp>;
+/**
+ * Query-string or form-encoded credential parameter, anchored at the start of
+ * the text or after `?`/`&` (URLs and `application/x-www-form-urlencoded` bodies).
+ */
+declare const credentialParamPattern: RegExp;
+/**
+ * The exact synthetic credential values a `PortFixture` may carry, keyed by lower-case parameter
+ * name: SigV4 presigned-URL placeholders for S3-compatible ports (the R2 conformance fixtures sign
+ * with them). `scanPortFixtureForSecrets` exempts a credential parameter only when its name is a
+ * key here and its whole raw value (up to `&`, `#`, whitespace, `"`, `<`, `>`, or the end),
+ * percent-decoded, equals that key's value exactly; anything else inside the value (a raw `?`, an
+ * encoded delimiter, any suffix), another parameter name, or another scope is flagged.
+ * `scanFixtureForSecrets` exempts nothing. Never build a placeholder by prefixing or suffixing a
+ * real value.
+ */
+declare const syntheticPortCredentialParams: Readonly<{
+  'x-amz-signature': "yolk-synthetic-signature";
+  'x-amz-credential': "yolk-synthetic-access-key-id/20260930/auto/s3/aws4_request";
+}>;
+/**
+ * True when `text` carries a credential query or form parameter that is not an exact synthetic
+ * placeholder (`syntheticPortCredentialParams`). Every `name=` is found and judged on its own: its
+ * raw value runs to the next structural boundary (see `rawParamValueAt`), is percent-decoded
+ * (`percentDecodedLayers`), and is exempt only when it equals that name's placeholder exactly. It
+ * flags at least whatever `credentialParamPattern` flags (a `name=` followed by any character but
+ * `&` or `#`), except the exact placeholders.
+ */
+declare const hasLiveCredentialParam: (text: string) => boolean;
+/** A JSON object key (or similar field name) that holds a credential. */
+declare const credentialFieldPattern: RegExp;
+/**
+ * Redact every credential pattern shared with the fixture secret scan: credential header lines
+ * (first, to the end of the line), quoted credential header keys (value only), bearer tokens,
+ * API-key prefixes, JWTs, private keys, credential field pairs (`"api_key": "..."`,
+ * `password="..."`), and credential query/form parameters. Best effort; used on report messages.
+ * Known gap: escaped JSON inside a quoted string value (`"body":"{\\"x-api-key\\":...}"`) is not
+ * parsed.
+ * Quote-aware field redaction runs before parameter redaction so a quoted value with spaces is
+ * removed whole.
+ */
+declare const redactCredentialText: (text: string) => string;
+declare const redactHeaders: (headers: Readonly<Record<string, string>>) => Record<string, string>;
+/**
+ * Canonical absolute URL used for matching: hash removed and query parameters
+ * sorted by name, then value. Unparseable input is returned unchanged.
+ */
+declare const normalizeWireUrl: (input: string) => string;
+/**
+ * Match an optional URL filter. A pattern ending in `*` is a prefix match on
+ * the normalized URL; otherwise the normalized URLs must be equal.
+ */
+declare const urlMatchesPattern: (pattern: string, normalizedUrl: string) => boolean;
+/** Request body as UTF-8 text when it is an in-memory body; otherwise undefined. */
+declare const requestBodyText: (request: HttpClientRequest.HttpClientRequest) => string | undefined;
+/** Exact bytes of standard base64 text; `None` when the text is not valid base64. */
+declare const decodeBase64Bytes: (text: string) => Option.Option<Uint8Array>;
+/**
+ * Decode bytes as UTF-8 only when they are valid UTF-8 on their own. A leading
+ * byte-order mark is kept so that re-encoding yields the same bytes.
+ */
+declare const decodeUtf8Strict: (bytes: Uint8Array) => Option.Option<string>;
+/** Lossless recording of bytes: readable text when valid UTF-8, otherwise base64. */
+declare const recordBytes: (bytes: Uint8Array) => {
+  readonly text: string;
+} | {
+  readonly base64: string;
+};
+/** Parse text as JSON; `None` when it is not valid JSON. */
+declare const parseJsonText: (text: string) => Effect.Effect<Option.Option<Schema.Json>>;
+declare const headerRecord: (headers: Readonly<Record<string, string | undefined>>) => Record<string, string>;
+declare const mediaType: (contentType: string | undefined) => string | undefined;
+declare const isNullBodyStatus: (status: number) => boolean;
+//#endregion
+export { apiKeyPatterns, bearerPattern, credentialFieldPattern, credentialParamPattern, decodeBase64Bytes, decodeUtf8Strict, hasLiveCredentialParam, headerRecord, isCredentialHeaderName, isNullBodyStatus, mediaType, normalizeWireUrl, parseJsonText, recordBytes, redactCredentialText, redactHeaders, redactedHeaderValue, requestBodyText, syntheticPortCredentialParams, urlMatchesPattern };
+//# sourceMappingURL=wire-internal.d.mts.map

package/dist/wire-internal.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-internal.d.mts","names":[],"sources":["../src/wire-internal.ts"],"mappings":";;;;;;;AAgCA;;cAAa,sBAAA,GAA0B,IAAY;AAAA,cAUtC,mBAAA;AAVsC;AAAA,cAgBtC,aAAA,EAAa,MAAuC;;cAsBpD,cAAA,EAAgB,aAAa,CAAC,MAAA;;AA5BX;AAMhC;;cA+Ba,sBAAA,EAAsB,MAAgE;;AA/BlC;AAsBjE;;;;AAAiD;AASjD;;;cAqBa,6BAAA,EAA6B,QAAA;;;;;;;;;;;AAwC1C;cAAa,sBAAA,GAA0B,IAAY;;cAkBtC,sBAAA,EAAsB,MAAiD;AAlBjC;AAkBnD;;;;AAAoF;AAmFpF;;;;AArGmD,cAqGtC,oBAAA,GAAwB,IAAY;AAAA,cAsBpC,aAAA,GAAiB,OAAA,EAAS,QAAA,CAAS,MAAA,sBAAuB,MAAA;;;;;cAsB1D,gBAAA,GAAoB,KAAa;;;;;cA4BjC,iBAAA,GAAqB,OAAA,UAAiB,aAAqB;;cAM3D,eAAA,GACX,OAAA,EAAS,iBAAA,CAAkB,iBAAiB;AAzDyB;AAAA,cAyE1D,iBAAA,GAAqB,IAAA,aAAe,MAAA,CAAO,MAAM,CAAC,UAAA;;;;AAnDjB;cA0DjC,gBAAA,GAAoB,KAAA,EAAO,UAAA,KAAa,MAAA,CAAO,MAAM;;cAMrD,WAAA,GACX,KAAA,EAAO,UAAU;EAAA,SACL,IAAA;AAAA;EAAA,SAA4B,MAAA;AAAA;;cAS7B,aAAA,GAAiB,IAAA,aAAe,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,IAAA;AAAA,cAGnE,YAAA,GAAgB,OAAA,EAAS,QAAA,CAAS,MAAA,kCAAmC,MAAA;AAAA,cAYrE,SAAA,GAAa,WAA+B;AAAA,cAM5C,gBAAA,GAAoB,MAAc"}

package/dist/wire-internal.mjs

@@ -0,0 +1,212 @@
+import { Effect, Encoding, Option, Predicate, Result } from "effect";
+import * as Schema from "effect/Schema";
+//#region src/wire-internal.ts
+const credentialHeaderNames = new Set([
+	"authorization",
+	"proxy-authorization",
+	"cookie",
+	"set-cookie",
+	"x-api-key",
+	"api-key",
+	"x-goog-api-key",
+	"x-auth-token",
+	"x-access-token",
+	"x-amz-security-token",
+	"x-vercel-oidc-token",
+	"x-csrf-token"
+]);
+const credentialHeaderPattern = /(api[-_]?key|secret|password|cookie|authorization)/i;
+const credentialHeaderSegmentPattern = /(^|[-_])(token|key|auth)([-_]|$)/i;
+/**
+* True for header names that carry credentials or session state. Used by the
+* fixture secret scan, recorder drop rules, and ledger redaction.
+*/
+const isCredentialHeaderName = (name) => {
+	const lower = name.toLowerCase();
+	return credentialHeaderNames.has(lower) || credentialHeaderPattern.test(lower) || credentialHeaderSegmentPattern.test(lower);
+};
+const redactedHeaderValue = "<redacted>";
+/** `Bearer <token>` with a token-shaped value. */
+const bearerPattern = /\bbearer\s+[A-Za-z0-9._~+/=-]{8,}/i;
+/** PEM private key header. */
+const privateKeyPattern = /-----BEGIN [A-Z ]*PRIVATE KEY-----/;
+/** Common API-key prefixes and JSON Web Tokens. */
+const tokenPrefixPatterns = [
+	/\bsk-[A-Za-z0-9_-]{16,}/,
+	/\b[sr]k_(live|test)_[A-Za-z0-9]{16,}/,
+	/\bxai-[A-Za-z0-9]{20,}/,
+	/\bvck_[A-Za-z0-9]{16,}/,
+	/\bgh[pousr]_[A-Za-z0-9]{20,}/,
+	/\bgithub_pat_[A-Za-z0-9_]{20,}/,
+	/\bAKIA[0-9A-Z]{16}\b/,
+	/\bAIza[0-9A-Za-z_-]{35}/,
+	/\bxox[abprs]-[A-Za-z0-9-]{10,}/,
+	/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/
+];
+/** Common API-key prefixes, JSON Web Tokens, and PEM private keys. */
+const apiKeyPatterns = [...tokenPrefixPatterns, privateKeyPattern];
+const credentialParamNames = "api[_-]?key|key|token|access[_-]?token|refresh[_-]?token|id[_-]?token|auth|secret|password|client[_-]?secret|x-amz-signature|x-amz-credential|x-amz-security-token";
+/**
+* Query-string or form-encoded credential parameter, anchored at the start of
+* the text or after `?`/`&` (URLs and `application/x-www-form-urlencoded` bodies).
+*/
+const credentialParamPattern = new RegExp(`(?:^|[?&])(${credentialParamNames})=[^&#]+`, "i");
+const credentialParamNamesAt = new RegExp(`(?:^|[?&])(${credentialParamNames})=`, "gi");
+const valueBoundary = /[&#\s"<>]/;
+/**
+* The exact synthetic credential values a `PortFixture` may carry, keyed by lower-case parameter
+* name: SigV4 presigned-URL placeholders for S3-compatible ports (the R2 conformance fixtures sign
+* with them). `scanPortFixtureForSecrets` exempts a credential parameter only when its name is a
+* key here and its whole raw value (up to `&`, `#`, whitespace, `"`, `<`, `>`, or the end),
+* percent-decoded, equals that key's value exactly; anything else inside the value (a raw `?`, an
+* encoded delimiter, any suffix), another parameter name, or another scope is flagged.
+* `scanFixtureForSecrets` exempts nothing. Never build a placeholder by prefixing or suffixing a
+* real value.
+*/
+const syntheticPortCredentialParams = Object.freeze({
+	"x-amz-signature": "yolk-synthetic-signature",
+	"x-amz-credential": "yolk-synthetic-access-key-id/20260930/auto/s3/aws4_request"
+});
+const exactPlaceholders = new Map(Object.entries(syntheticPortCredentialParams));
+/**
+* `text` with `%XX` escapes decoded, repeatedly (at most three layers, then left as it is). The R2
+* guard (`findR2PortFixtureSecrets` in `@yolk-sdk/connectors`) applies at most the same three
+* percent-decoding rounds (plus its escape rounds): keep the percent depth in step.
+*/
+const percentDecodedLayers = (text) => {
+	let current = text;
+	for (let round = 0; round < 3 && /%[0-9A-Fa-f]{2}/.test(current); round++) current = current.replace(/%([0-9A-Fa-f]{2})/g, (_match, hex) => String.fromCharCode(Number.parseInt(hex, 16)));
+	return current;
+};
+/** The raw, undecoded value starting at `start`: up to the first structural boundary. */
+const rawParamValueAt = (text, start) => {
+	const rest = text.slice(start);
+	const end = rest.search(valueBoundary);
+	return end === -1 ? rest : rest.slice(0, end);
+};
+/**
+* True when `text` carries a credential query or form parameter that is not an exact synthetic
+* placeholder (`syntheticPortCredentialParams`). Every `name=` is found and judged on its own: its
+* raw value runs to the next structural boundary (see `rawParamValueAt`), is percent-decoded
+* (`percentDecodedLayers`), and is exempt only when it equals that name's placeholder exactly. It
+* flags at least whatever `credentialParamPattern` flags (a `name=` followed by any character but
+* `&` or `#`), except the exact placeholders.
+*/
+const hasLiveCredentialParam = (text) => [...text.matchAll(credentialParamNamesAt)].some((match) => {
+	const name = (match[1] ?? "").toLowerCase();
+	const start = match.index + match[0].length;
+	const value = rawParamValueAt(text, start);
+	const next = text.charAt(start);
+	return (value.length > 0 || next !== "" && next !== "&" && next !== "#") && exactPlaceholders.get(name) !== percentDecodedLayers(value);
+});
+const credentialFieldNames = "(?:access|refresh|id|auth|api|session|private|bearer|oauth)[_-]?token|token|client[_-]?secret|secret(?:[_-]?key)?|private[_-]?key|password|passwd|api[_-]?key|access[_-]?key[_-]?id|secret[_-]?access[_-]?key|authorization";
+/** A JSON object key (or similar field name) that holds a credential. */
+const credentialFieldPattern = new RegExp(`^(${credentialFieldNames})$`, "i");
+const globally = (pattern) => new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`);
+const bearerRedaction = /\bbearer\s+\S+/gi;
+const apiKeyRedactions = [...tokenPrefixPatterns.map(globally), /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g];
+const credentialParamRedaction = new RegExp(`(^|[?&\\s;,(])(${credentialParamNames})=[^&#\\s;,)]+`, "gi");
+const credentialFieldRedaction = new RegExp(`(^|[^A-Za-z0-9_-])(["']?)(${credentialFieldNames})\\2(\\s*[:=]\\s*)(?!bearer <redacted>)(?:"(?:[^"\\\\]|\\\\.)*"?|'[^']*'?|(?:(?:basic|bearer|digest|negotiate|token)\\s+)?[^\\s,;&}\\]]+)`, "gi");
+const headerLikeNamePattern = /(?:^|[^A-Za-z0-9_-])([A-Za-z][A-Za-z0-9_-]*)\s*:/g;
+/**
+* Redact the rest of a line after the first header-like `Name:` that `isCredentialHeaderName`
+* accepts (`X-Api-Key: ...`, `Proxy-Authorization: Basic ...`, `Cookie: ...`), so every header the
+* fixture scan flags is also redacted in report text. Runs on the raw text before any other pass,
+* so a partially matched value (for example a key-shaped cookie name) never shields the rest of
+* the line.
+*/
+const redactCredentialHeaderLines = (text) => text.split(/(\r\n|\r|\n)/).map((line) => {
+	headerLikeNamePattern.lastIndex = 0;
+	for (let match = headerLikeNamePattern.exec(line); match !== null;) {
+		const name = match[1];
+		if (name !== void 0 && isCredentialHeaderName(name)) return `${line.slice(0, match.index + match[0].length)} ${redactedHeaderValue}`;
+		match = headerLikeNamePattern.exec(line);
+	}
+	return line;
+}).join("");
+const quotedCredentialHeaderRedaction = /(["'])([A-Za-z][A-Za-z0-9_-]*)\1(\s*:\s*)("(?:[^"\\]|\\.)*"?|'[^']*'?|[^\s,;&{}[\]]+)/g;
+const redactQuotedCredentialHeaders = (text) => text.replace(quotedCredentialHeaderRedaction, (match, quote, name, separator) => isCredentialHeaderName(name) ? `${quote}${name}${quote}${separator}${redactedHeaderValue}` : match);
+/**
+* Redact every credential pattern shared with the fixture secret scan: credential header lines
+* (first, to the end of the line), quoted credential header keys (value only), bearer tokens,
+* API-key prefixes, JWTs, private keys, credential field pairs (`"api_key": "..."`,
+* `password="..."`), and credential query/form parameters. Best effort; used on report messages.
+* Known gap: escaped JSON inside a quoted string value (`"body":"{\\"x-api-key\\":...}"`) is not
+* parsed.
+* Quote-aware field redaction runs before parameter redaction so a quoted value with spaces is
+* removed whole.
+*/
+const redactCredentialText = (text) => {
+	let result = redactCredentialHeaderLines(text).replace(bearerRedaction, `Bearer ${redactedHeaderValue}`);
+	for (const pattern of apiKeyRedactions) result = result.replace(pattern, redactedHeaderValue);
+	return redactQuotedCredentialHeaders(result).replace(credentialFieldRedaction, (_match, prefix, quote, name, separator) => `${prefix}${quote}${name}${quote}${separator}${redactedHeaderValue}`).replace(credentialParamRedaction, (_match, prefix, name) => `${prefix}${name}=${redactedHeaderValue}`);
+};
+const redactHeaders = (headers) => {
+	const redacted = {};
+	for (const [name, value] of Object.entries(headers)) redacted[name] = isCredentialHeaderName(name) ? redactedHeaderValue : value;
+	return redacted;
+};
+const compareStrings = (left, right) => {
+	if (left < right) return -1;
+	return left > right ? 1 : 0;
+};
+/**
+* Canonical absolute URL used for matching: hash removed and query parameters
+* sorted by name, then value. Unparseable input is returned unchanged.
+*/
+const normalizeWireUrl = (input) => {
+	if (!URL.canParse(input)) return input;
+	const url = new URL(input);
+	url.hash = "";
+	const params = [...url.searchParams.entries()].sort(([leftName, leftValue], [rightName, rightValue]) => leftName === rightName ? compareStrings(leftValue, rightValue) : compareStrings(leftName, rightName));
+	url.search = "";
+	for (const [name, value] of params) url.searchParams.append(name, value);
+	return url.toString();
+};
+/**
+* Match an optional URL filter. A pattern ending in `*` is a prefix match on
+* the normalized URL; otherwise the normalized URLs must be equal.
+*/
+const urlMatchesPattern = (pattern, normalizedUrl) => pattern.endsWith("*") ? normalizedUrl.startsWith(pattern.slice(0, -1)) : normalizeWireUrl(pattern) === normalizedUrl;
+/** Request body as UTF-8 text when it is an in-memory body; otherwise undefined. */
+const requestBodyText = (request) => {
+	const body = request.body;
+	if (Predicate.isTagged(body, "Uint8Array")) return new TextDecoder().decode(body.body);
+	if (Predicate.isTagged(body, "Raw") && Predicate.isString(body.body)) return body.body;
+};
+/** Exact bytes of standard base64 text; `None` when the text is not valid base64. */
+const decodeBase64Bytes = (text) => Result.getSuccess(Encoding.decodeBase64(text));
+/**
+* Decode bytes as UTF-8 only when they are valid UTF-8 on their own. A leading
+* byte-order mark is kept so that re-encoding yields the same bytes.
+*/
+const decodeUtf8Strict = (bytes) => Option.liftThrowable(() => new TextDecoder("utf-8", {
+	fatal: true,
+	ignoreBOM: true
+}).decode(bytes))();
+/** Lossless recording of bytes: readable text when valid UTF-8, otherwise base64. */
+const recordBytes = (bytes) => Option.match(decodeUtf8Strict(bytes), {
+	onNone: () => ({ base64: Encoding.encodeBase64(bytes) }),
+	onSome: (text) => ({ text })
+});
+const decodeJsonText = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Json));
+/** Parse text as JSON; `None` when it is not valid JSON. */
+const parseJsonText = (text) => decodeJsonText(text).pipe(Effect.option);
+const headerRecord = (headers) => {
+	const record = {};
+	for (const [name, value] of Object.entries(headers)) if (value !== void 0) record[name.toLowerCase()] = value;
+	return record;
+};
+const mediaType = (contentType) => contentType?.split(";", 1)[0]?.trim().toLowerCase();
+const nullBodyStatuses = new Set([
+	101,
+	103,
+	204,
+	205,
+	304
+]);
+const isNullBodyStatus = (status) => nullBodyStatuses.has(status);
+//#endregion
+export { apiKeyPatterns, bearerPattern, credentialFieldPattern, credentialParamPattern, decodeBase64Bytes, decodeUtf8Strict, hasLiveCredentialParam, headerRecord, isCredentialHeaderName, isNullBodyStatus, mediaType, normalizeWireUrl, parseJsonText, recordBytes, redactCredentialText, redactHeaders, redactedHeaderValue, requestBodyText, syntheticPortCredentialParams, urlMatchesPattern };
+
+//# sourceMappingURL=wire-internal.mjs.map