my-durable 0.0.3 → 0.0.5

package/apps/dpi-playground/apps/dpi-playground-fe/dist/index.html

@@ -7,8 +7,8 @@
     <meta name="referrer" content="no-referrer" />
     <link rel="icon" type="image/svg+xml" href="/icons/durable-pi.svg" />
     <title>Durable Pi | Network</title>
-    <script type="module" crossorigin src="/assets/index-CFGc7lHT.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-DFdKpwm_.css">
+    <script type="module" crossorigin src="/assets/index-Dq0CZYr7.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index--aoZ5Tj0.css">
   </head>
   <body>
     <div id="app"></div>

package/apps/dpi-playground/apps/dpi-playground-fe/src/App.vue

@@ -13,6 +13,7 @@ import DeviceCredentialsDialog from "./components/DeviceCredentialsDialog.vue";
 import PromptDialog from "./components/PromptDialog.vue";
 import ModelPicker from "./components/ModelPicker.vue";
 import HelpDialog from "./components/HelpDialog.vue";
+import LoginCard from "./components/LoginCard.vue";
 import Toast from "./components/Toast.vue";
 import {
   boot,
@@ -32,6 +33,7 @@ import {
   toggleTree,
   toggleInspector,
 } from "./client/store";
+import { auth } from "./client/auth";
 
 const onlineCount = () => network.devices.value.filter((d) => d.status === "online").length;
 const pairWizard = ref<{ close(): Promise<void> }>();
@@ -175,6 +177,7 @@ onBeforeUnmount(() => {
       </section>
     </div>
     <HelpDialog v-else-if="ui.dialog?.kind === 'help'" />
+    <LoginCard v-if="auth.needed" />
     <Toast />
   </div>
 </template>

package/apps/dpi-playground/apps/dpi-playground-fe/src/client/auth.ts

@@ -0,0 +1,108 @@
+// Admin session for the browser. The ONLY browser credential is the hub's
+// `dpi_admin` cookie (HttpOnly — script can never read it); no token is kept in
+// localStorage, sessionStorage or the URL.
+//
+// `installAdminLoginFetch` wraps window.fetch once at startup: any 401 from an
+// admin call raises the login card (LoginCard.vue), waits for a successful
+// login, then retries the failed call exactly once and the app continues where
+// it was. The login call itself is never intercepted.
+import { reactive } from "vue";
+
+export const auth = reactive({
+  /** True while a 401 is waiting for the operator to sign in. */
+  needed: false,
+  busy: false,
+  error: "",
+});
+
+type Waiter = (ok: boolean) => void;
+let waiters = new Set<Waiter>();
+
+const release = (ok: boolean) => {
+  const pending = [...waiters];
+  waiters = new Set();
+  for (const w of pending) w(ok);
+};
+
+const waitForLogin = () => new Promise<boolean>((done) => waiters.add(done));
+
+/** POST /api/session with the typed token; on success every waiting call retries. */
+export async function login(token: string): Promise<boolean> {
+  if (auth.busy || !token) return false;
+  auth.busy = true;
+  auth.error = "";
+  try {
+    const r = await fetch("/api/session", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ token }),
+    });
+    // Read the body in full: an unconsumed fetch body is cancelled once its Response is
+    // garbage-collected, and harnesses that record response bodies must still read it.
+    const body = await r.text().catch(() => "");
+    if (r.ok) {
+      auth.needed = false;
+      release(true);
+      return true;
+    }
+    auth.error =
+      r.status === 401
+        ? "That token was not accepted."
+        : r.status === 429
+          ? "Too many attempts. Wait a minute and try again."
+          : `Login failed (${r.status}).`;
+    void body;
+    return false;
+  } catch {
+    auth.error = "Cannot reach the hub.";
+    return false;
+  } finally {
+    auth.busy = false;
+  }
+}
+
+/** Dismiss the card: waiting calls get their original 401 back. */
+export function cancelLogin(): void {
+  auth.needed = false;
+  auth.error = "";
+  release(false);
+}
+
+const isSessionCall = (url: string) => {
+  try {
+    return new URL(url, location.href).pathname === "/api/session";
+  } catch {
+    return url === "/api/session";
+  }
+};
+
+/**
+ * Wrap `fetch`: a 401 on anything except the login call itself raises the login
+ * card, and after a successful login the SAME request is retried once. A stream
+ * body cannot be replayed, so those are left alone.
+ */
+export function withAdminLogin(native: typeof fetch): typeof fetch {
+  return (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const call = () => native(input, init);
+    const response = await call();
+    if (response.status !== 401) return response;
+    const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+    if (isSessionCall(url) || init?.body instanceof ReadableStream) return response;
+    auth.needed = true;
+    // Drain the refused body now: an unconsumed fetch body is cancelled when its Response
+    // is garbage-collected, and harnesses that record response bodies (tests/pairing-ui.mjs)
+    // must still be able to read it afterwards. A cancelled login hands the caller an
+    // equivalent Response so its own r.json() keeps working.
+    const text = await response.text().catch(() => "");
+    if (!(await waitForLogin()))
+      return new Response(text, { status: response.status, headers: response.headers });
+    return call();
+  }) as typeof fetch;
+}
+
+/** Patch window.fetch with the 401 retry; install once, before the first call. */
+export function installAdminLoginFetch(): void {
+  if (typeof window === "undefined" || (window as { __adminFetch?: boolean }).__adminFetch) return;
+  (window as { __adminFetch?: boolean }).__adminFetch = true;
+  window.fetch = withAdminLogin(window.fetch.bind(window));
+}

package/apps/dpi-playground/apps/dpi-playground-fe/src/client/pair-handoff.ts

@@ -1,18 +1,33 @@
 /** Pair links stay in RAM and may only refer to the browser's own hub. */
+import { decodePairOffer, normalizePairCode, parsePairOfferUrl } from "../../../../../dpi-sdk/src/protocol/pairing";
+
 export type PairHandoff = { code: string; origin: string } | { error: string };
 
 export function readPairHandoff(url: URL): PairHandoff | undefined {
   if (!/^\/pair\/?$/.test(url.pathname)) return undefined;
+  // v2 FIRST: the whole handoff rides the #offer= fragment, decoded client-side —
+  // the code never travels in a query, so it never reaches any server or CDN log.
+  if (url.hash.startsWith("#offer=")) {
+    const parsed = parsePairOfferUrl(url.href);
+    if (parsed) return { code: parsed.offer.code, origin: url.origin };
+    const offer = decodePairOffer(url.hash.slice("#offer=".length));
+    if (offer && offer.hub !== url.origin)
+      return {
+        error: "This pairing link does not belong to this hub. Open the original hub link instead.",
+      };
+    return { error: "Invalid pairing link. Use a complete link from the hub wizard." };
+  }
   const params = url.searchParams;
   if (!params.has("code") && !params.has("origin") && !params.has("v")) return undefined;
   const code = params.get("code");
+  // The SDK owns the code shape: canonicalise a grouped/lower-case value, refuse anything else.
+  const canonical = code === null ? undefined : normalizePairCode(code);
   if (
     url.username ||
     url.password ||
     url.hash ||
     params.getAll("code").length !== 1 ||
-    !code ||
-    !/^[A-Z2-7]{8}$/.test(code) ||
+    !canonical ||
     params.getAll("v").length !== 1 ||
     params.get("v") !== "1"
   ) {
@@ -37,7 +52,7 @@ export function readPairHandoff(url: URL): PairHandoff | undefined {
       };
     }
   }
-  return { code, origin: url.origin };
+  return { code: canonical, origin: url.origin };
 }
 
 /**

package/apps/dpi-playground/apps/dpi-playground-fe/src/components/LoginCard.vue

@@ -0,0 +1,59 @@
+<script setup lang="ts">
+// The admin gate: one centered card with one password-type input. Shown when any
+// admin call answered 401 (client/auth.ts); a successful login retries the call
+// that was interrupted. The token itself lives only in the HttpOnly cookie — it
+// is never stored or echoed anywhere the page can read.
+import { nextTick, onMounted, ref } from "vue";
+import { auth, login } from "../client/auth";
+
+const token = ref("");
+const input = ref<HTMLInputElement>();
+
+async function submit() {
+  if (auth.busy || !token.value.trim()) return;
+  const ok = await login(token.value.trim());
+  token.value = "";
+  if (ok) input.value?.blur();
+}
+
+onMounted(() => void nextTick(() => input.value?.focus()));
+</script>
+
+<template>
+  <div class="login-veil" data-testid="login-card">
+    <form
+      class="modal login-card"
+      role="dialog"
+      aria-modal="true"
+      aria-labelledby="login-title"
+      @submit.prevent="submit"
+    >
+      <header>
+        <h2 id="login-title">Admin token</h2>
+      </header>
+      <p class="hint">
+        This hub is locked. Sign in with the token from its <code>admin.token</code> file.
+      </p>
+      <label for="admin-token">Admin token</label>
+      <input
+        id="admin-token"
+        ref="input"
+        v-model="token"
+        type="password"
+        name="admin-token"
+        autocomplete="off"
+        spellcheck="false"
+        placeholder="adm_…"
+        aria-label="Admin token"
+        :disabled="auth.busy"
+        @keydown.esc="auth.error = ''"
+      />
+      <p v-if="auth.error" class="message-error" role="alert">{{ auth.error }}</p>
+      <footer>
+        <button class="primary" type="submit" :disabled="auth.busy || !token.trim()">
+          {{ auth.busy ? "Checking…" : "Sign in" }}
+        </button>
+      </footer>
+    </form>
+  </div>
+</template>

package/apps/dpi-playground/apps/dpi-playground-fe/src/components/PairDeviceWizard.vue

@@ -22,6 +22,7 @@ import { createPairingSession, pairingAdmin, pollCode, type PairingSession } fro
 import { qrSvg } from "../client/qrcode";
 import type { PairCodeIssue, PairCodeState } from "@sdk/api";
 import { DpiError } from "@sdk/errors";
+import { isPairCode } from "@sdk/protocol/pairing";
 import { settledPairPath, type PairHandoff } from "../client/pair-handoff";
 import { CANCEL_TIMEOUT_MS, closeWizard, type CancelResult } from "../client/pair-close";
 import { notify, network } from "../client/store";
@@ -41,11 +42,16 @@ const closing = ref(false);
 const confirmed = ref(false);
 const replaceKey = ref(false);
 const copied = ref(false);
+const linkCopied = ref(false);
 const watcher = ref<(() => void) | undefined>();
 
 const grouped = computed(() => {
   const code = issue.value?.code ?? "";
-  return code.length === 8 ? `${code.slice(0, 4)}-${code.slice(4)}` : code;
+  if (!isPairCode(code)) return code; // never invent separators around an unsupported value
+  // A minted code is a UUID v4: its hyphens are structure, so it is shown as it is.
+  if (code.includes("-")) return code;
+  // Legacy base32 (12 | 8 chars) reads better in blocks of four: `ABCD-2345-EF67`.
+  return (code.match(/.{4}/g) ?? []).join("-");
 });
 const qrData = computed(() => {
   if (!issue.value) return "";
@@ -205,6 +211,18 @@ async function copyCode(): Promise<void> {
   }
 }
 
+/** Copies the v2 offer link (code never in a query); falls back to the v1 pair URL. */
+async function copyLink(): Promise<void> {
+  if (!issue.value) return;
+  try {
+    await navigator.clipboard.writeText(issue.value.offerUrl ?? issue.value.pairUrl);
+    linkCopied.value = true;
+    setTimeout(() => (linkCopied.value = false), 1500);
+  } catch {
+    error.value = "Clipboard unavailable; copy the link manually.";
+  }
+}
+
 async function close(): Promise<void> {
   if (closing.value) return;
   closing.value = true;
@@ -275,9 +293,14 @@ onBeforeUnmount(() => {
         <div class="pair-grid">
           <div class="pair-code-box">
             <div class="pair-code" aria-label="Pairing code">{{ grouped }}</div>
-            <button type="button" class="small" @click="copyCode">
-              <Copy :size="14" /> {{ copied ? "Copied" : "Copy code" }}
-            </button>
+            <div class="pair-copy-actions">
+              <button type="button" class="small" @click="copyCode">
+                <Copy :size="14" /> {{ copied ? "Copied" : "Copy code" }}
+              </button>
+              <button type="button" class="small" @click="copyLink" title="Self-contained link: hub, code and expiry all in the fragment — it never reaches server logs">
+                <Copy :size="14" /> {{ linkCopied ? "Copied link" : "Copy link" }}
+              </button>
+            </div>
             <p class="hint">
               Run the device pairing command and scan, or enter this code on the device. Expires in
               5 minutes.
@@ -395,6 +418,11 @@ onBeforeUnmount(() => {
   font-family: var(--mono, monospace);
   margin-bottom: 0.35rem;
 }
+.pair-wizard .pair-copy-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.4rem;
+}
 .pair-wizard .pair-qr svg {
   border: 1px solid var(--border, #333);
   border-radius: 6px;

package/apps/dpi-playground/apps/dpi-playground-fe/src/main.ts

@@ -1,11 +1,15 @@
 import { createApp } from "vue";
 import App from "./App.vue";
 import { ui } from "./client/store";
+import { installAdminLoginFetch } from "./client/auth";
 import { barePairHome, readPairHandoff } from "./client/pair-handoff";
 import "./style.css";
 import "./network.css";
 import "./jobs.css";
 import "./extensions.css";
+// Before anything can call out: a 401 from an admin route raises the login card
+// and the failed call is retried after a successful login (client/auth.ts).
+installAdminLoginFetch();
 const url = new URL(window.location.href);
 if (/^\/pair\/?$/.test(url.pathname)) {
   const handoff = readPairHandoff(url);

package/apps/dpi-playground/apps/dpi-playground-fe/src/style.css

@@ -1753,6 +1753,30 @@ svg {
   flex-direction: column;
   overflow: hidden;
 }
+/* The admin gate: one centered card over a dark veil while a 401 waits for the
+   operator's token. Same panel/border/radius language as the dialogs. */
+.login-veil {
+  position: fixed;
+  inset: 0;
+  z-index: 100;
+  background: #0d0808e0;
+  backdrop-filter: blur(7px);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 24px;
+}
+.login-card {
+  width: 400px;
+}
+.login-card .hint {
+  color: var(--fg);
+  font-size: 15px;
+  line-height: 1.55;
+}
+.login-card footer {
+  justify-content: flex-end;
+}
 .model-list {
   overflow: auto;
   margin-top: 12px;

package/apps/dpi-playground/apps/dpi-playground-hub/src/admin-auth.ts

@@ -0,0 +1,168 @@
+/**
+ * Hub admin authentication (the operator's own credential — devices use pairing
+ * credentials and never see any of this).
+ *
+ * Token bootstrap (mirrors the device-side DPI_TOKEN bootstrap):
+ * - `DPI_ADMIN_TOKEN` env wins outright; anything shorter than 32 characters is a
+ *   configuration mistake and REFUSES to boot — it is never silently replaced.
+ * - Otherwise the token is minted at first boot (`adm_` + 32 random bytes,
+ *   base64url) into `<DPI_HOME>/admin.token` (or `DPI_ADMIN_TOKEN_FILE`),
+ *   owner-only 0600, and logged once.
+ *
+ * Presentation:
+ * - Browsers: `POST /api/session {token}` sets a stateless cookie `dpi_admin` =
+ *   base64url(payload) + "." + base64url(HMAC-SHA256(payload, adminToken)) with
+ *   payload `{"exp":<ms>}`. HttpOnly, SameSite=Strict, Path=/, 4 h, `Secure` when
+ *   the request arrived via the TLS proxy. Forging it requires the token itself;
+ *   it survives a hub restart because it carries no server-side state.
+ * - Non-browser clients (TUI, tests, curl): the raw token as
+ *   `Authorization: Bearer <adm_…>` or `X-Admin-Token`.
+ *
+ * Every comparison hashes both sides with SHA-256 first and uses timingSafeEqual
+ * (the device-side bearerAuth pattern), so the cookie HMAC and the raw token are
+ * both compared in constant time.
+ */
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import type { RequestHandler } from "express";
+import { homedir } from "node:os";
+
+export const ADMIN_COOKIE = "dpi_admin";
+/** How long a login cookie is worth. */
+export const SESSION_TTL_MS = 4 * 60 * 60 * 1000;
+/** A set-but-short env token is a configuration mistake, never replaced silently. */
+export const MIN_TOKEN_CHARS = 32;
+/** Login attempts per client address: 5 per minute, burst 5. */
+export const LOGIN_RATE = { capacity: 5, perMinute: 5 } as const;
+
+const sha256 = (value: string) => createHash("sha256").update(value, "utf8").digest();
+
+/** Constant-time string equality (hash first so lengths cannot leak). */
+export function tokenEquals(presented: string, expected: string): boolean {
+  const a = sha256(presented);
+  const b = sha256(expected);
+  return timingSafeEqual(a, b);
+}
+
+export interface AdminTokenInfo {
+  token: string;
+  /** Where the token file lives (even when the env override is in force). */
+  path: string;
+  /** True when this boot minted the token file. */
+  created: boolean;
+}
+
+/**
+ * Resolve the admin token at boot: env override (>= 32 chars or throw), the
+ * existing token file, or a freshly minted one written 0600.
+ */
+export function bootstrapAdminToken(
+  home = process.env.DPI_HOME ?? join(homedir(), ".dpi"),
+): AdminTokenInfo {
+  const path = process.env.DPI_ADMIN_TOKEN_FILE ?? join(home, "admin.token");
+  const env = process.env.DPI_ADMIN_TOKEN;
+  if (env !== undefined && env !== "") {
+    if (env.length < MIN_TOKEN_CHARS)
+      throw Error(
+        `DPI_ADMIN_TOKEN is ${env.length} characters; an admin token must be at least ${MIN_TOKEN_CHARS}. ` +
+          "A short token is a configuration mistake — fix it or unset the variable; the hub will not replace it.",
+      );
+    return { token: env, path, created: false };
+  }
+  let existing = "";
+  try {
+    existing = readFileSync(path, "utf8").trim();
+  } catch {
+    /* first run (or an unreadable file): mint below */
+  }
+  if (existing) {
+    // The token file must stay 0600 — tighten quietly if a copy restored looser bits
+    // (the same quiet re-tightening Audit applies to the registry file).
+    try {
+      if ((statSync(path).mode & 0o777) !== 0o600) chmodSync(path, 0o600);
+    } catch {
+      /* best effort */
+    }
+    return { token: existing, path, created: false };
+  }
+  const token = `adm_${randomBytes(32).toString("base64url")}`;
+  // DPI_ADMIN_TOKEN_FILE may name a directory that does not exist yet — create it
+  // owner-only rather than refusing the operator's explicit choice of location.
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  writeFileSync(path, `${token}\n`, { mode: 0o600 });
+  chmodSync(path, 0o600); // a pre-existing (e.g. empty) file may carry wider bits
+  console.log(`first run: created admin token in ${path}`);
+  return { token, path, created: true };
+}
+
+/** The cookie value for a session expiring at `exp` (epoch ms). */
+export function signSession(adminToken: string, exp: number): string {
+  const payload = Buffer.from(JSON.stringify({ exp }), "utf8").toString("base64url");
+  const mac = createHmac("sha256", adminToken).update(payload).digest("base64url");
+  return `${payload}.${mac}`;
+}
+
+/** True when `cookie` is a well-formed, correctly signed, unexpired session. */
+export function verifySession(
+  adminToken: string,
+  cookie: string | undefined,
+  now = Date.now(),
+): boolean {
+  if (!cookie) return false;
+  const dot = cookie.indexOf(".");
+  if (dot <= 0) return false;
+  const payload = cookie.slice(0, dot);
+  const given = cookie.slice(dot + 1);
+  const expected = createHmac("sha256", adminToken).update(payload).digest("base64url");
+  const a = Buffer.from(given);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length || !timingSafeEqual(a, b)) return false;
+  try {
+    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as {
+      exp?: unknown;
+    };
+    return typeof parsed.exp === "number" && Number.isFinite(parsed.exp) && parsed.exp > now;
+  } catch {
+    return false;
+  }
+}
+
+/** The `dpi_admin` value from a raw Cookie header, or undefined. */
+export function adminCookie(header: string | string[] | undefined): string | undefined {
+  const cookies = Array.isArray(header) ? header.join("; ") : header;
+  if (!cookies) return undefined;
+  for (const part of cookies.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq <= 0) continue;
+    if (part.slice(0, eq).trim() === ADMIN_COOKIE) return part.slice(eq + 1).trim();
+  }
+  return undefined;
+}
+
+/** The presented raw token: `Authorization: Bearer <t>` or `X-Admin-Token: <t>`. */
+export function bearerToken(req: { headers: Record<string, unknown> }): string {
+  const auth = req.headers.authorization;
+  const header = typeof auth === "string" ? auth : "";
+  if (header.startsWith("Bearer ")) return header.slice(7).trim();
+  const alt = req.headers["x-admin-token"];
+  return typeof alt === "string" ? alt.trim() : "";
+}
+
+/**
+ * Require the admin credential (cookie or bearer) on a route. Answers
+ * `{error:{code:"unauthorized"}}` with 401 otherwise.
+ */
+export function requireAdmin(adminToken: string): RequestHandler {
+  return (req, res, next) => {
+    const bearer = bearerToken(req);
+    if (
+      (bearer && tokenEquals(bearer, adminToken)) ||
+      verifySession(adminToken, adminCookie(req.headers.cookie))
+    )
+      return void next();
+    res
+      .status(401)
+      .json({ error: { code: "unauthorized", message: "Admin authentication required" } });
+  };
+}

package/apps/dpi-playground/apps/dpi-playground-hub/src/audit.ts

@@ -38,6 +38,8 @@ export const AUDIT_ACTIONS = [
   "token.rotate_regenerated",
   "tunnel.connect",
   "tunnel.disconnect",
+  "admin.token_created",
+  "admin.login",
   "auth.denied",
   "rate_limited",
   "tunnel.listener_error",
@@ -90,6 +92,8 @@ export function scrubSecrets(value: string): string {
   let out = value;
   out = out.replace(/dpt_[A-Za-z0-9_-]{1,64}/g, "dpt_<redacted>");
   out = out.replace(/dpi_[A-Za-z0-9_-]{1,64}/g, "dpi_<redacted>");
+  // The hub's own admin token (adm_ + 32 random bytes, base64url).
+  out = out.replace(/adm_[A-Za-z0-9_-]{32,}/g, "adm_<redacted>");
   out = out.replace(
     /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(-----END [A-Z ]*PRIVATE KEY-----|$)/g,
     "<private-key-redacted>",
@@ -97,10 +101,18 @@ export function scrubSecrets(value: string): string {
   out = out.replace(/(authorization\s*[:=]\s*)(\S+)/gi, "$1<redacted>");
   out = out.replace(/(bearer\s+)([A-Za-z0-9._-]{8,})/gi, "$1<redacted>");
   out = out.replace(/([?&]code=)[A-Za-z0-9_-]+/g, "$1<redacted>");
+  // v2 offer links: the secret IS the #offer= fragment payload — redact it wherever a URL shows up.
+  out = out.replace(/(#offer=)[A-Za-z0-9_-]+/g, "$1<redacted>");
   // Credential material without its prefix (slices, echo): 43-char base64url runs.
   out = out.replace(/(?<![A-Za-z0-9_-])[A-Za-z0-9_-]{43}(?![A-Za-z0-9_-])/g, "<redacted>");
-  // Pairing codes as standalone values ("code":"AB2C7DEF") but not ordinary words.
-  out = out.replace(/(["'?=:,\s])([A-Z2-7]{8})(?=["'?\s:,}]|$)/g, "$1<code-redacted>");
+  // Pairing codes as standalone values ("code":"AB2C7DEF" / "ABCD2345EF67") but not ordinary words.
+  out = out.replace(/(["'?=:,\s])([A-Z2-7]{12}|[A-Z2-7]{8})(?=["'?\s:,}]|$)/g, "$1<code-redacted>");
+  // A MINTED code is a canonical UUID v4. Only a value LABELLED a code is a secret here: an audit
+  // row's own codeId/enrollmentId are correlation ids and must stay readable.
+  out = out.replace(
+    /(\bcode["']?\s*[:=]\s*["']?)([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})(?=["'?\s:,}&]|$)/gi,
+    "$1<code-redacted>",
+  );
   return out;
 }