peaks-loop 4.0.0-beta.8 → 4.0.0-beta.9

package/dist/services/legacy/legacy-detector.js

@@ -0,0 +1,111 @@
+/**
+ * v2.15.0 follow-up — G8: legacy code detector.
+ *
+ * 12 Gaps memory: when peaks-loop is applied to a 存量老项目 (legacy
+ * codebase), it is helpful to surface a quick inventory of "what
+ * smells old" so the LLM / operator knows where to focus.
+ *
+ * Heuristics (intentionally light, since the user is Senior FE and
+ * the AI is the integrator):
+ *   - TODO / FIXME / HACK comments
+ *   - console.log calls (debug leftover)
+ *   - any-type TypeScript annotations (`as any`, `: any`)
+ *   - large files (> 500 lines)
+ *   - ts-ignore / @ts-expect-error (suppressed type errors)
+ *
+ * Pure function. No I/O. The CLI is `peaks legacy detect`.
+ */
+import { readFileSync, readdirSync, existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+const PATTERNS = [
+    { kind: 'todo', regex: /(?:\/\/|\/\*|<!--)\s*(?:TODO|FIXME|HACK|XXX)\b/i },
+    { kind: 'console-log', regex: /\bconsole\.(log|debug|info)\s*\(/ },
+    { kind: 'any-type', regex: /\b(?:as\s+any|:\s*any\b|<any>)/ },
+    { kind: 'ts-ignore', regex: /@ts-(?:ignore|expect-error|nocheck)/ }
+];
+const LARGE_FILE_LINES = 500;
+function scanFile(file) {
+    let content;
+    try {
+        content = readFileSync(file, 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const lines = content.split('\n');
+    const findings = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const { kind, regex } of PATTERNS) {
+            if (regex.test(line)) {
+                findings.push({ kind, file, line: i + 1, excerpt: line.trim().slice(0, 120) });
+                break; // one finding per line (avoid double-counting)
+            }
+        }
+    }
+    if (lines.length > LARGE_FILE_LINES) {
+        findings.push({ kind: 'large-file', file, line: null, excerpt: `${lines.length} lines (> ${LARGE_FILE_LINES})` });
+    }
+    return findings;
+}
+function walkFiles(root, maxDepth = 8) {
+    const out = [];
+    function walk(dir, depth) {
+        if (depth > maxDepth)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (e.name === 'node_modules' || e.name === '.git' || e.name === 'dist' || e.name === 'node_modules' || e.name.startsWith('.'))
+                continue;
+            const full = join(dir, e.name);
+            if (e.isDirectory())
+                walk(full, depth + 1);
+            else if (e.isFile() && (e.name.endsWith('.ts') || e.name.endsWith('.js') || e.name.endsWith('.tsx') || e.name.endsWith('.jsx'))) {
+                out.push(full);
+            }
+        }
+    }
+    walk(root, 0);
+    return out;
+}
+export function detectLegacy(projectRoot, dir = 'src') {
+    const root = resolve(projectRoot, dir);
+    if (!existsSync(root)) {
+        const empty = { todo: 0, 'console-log': 0, 'any-type': 0, 'large-file': 0, 'ts-ignore': 0, fixme: 0, hack: 0 };
+        return { projectRoot, scannedFiles: 0, findings: [], summary: empty, smells: 'low' };
+    }
+    const files = walkFiles(root);
+    const findings = [];
+    for (const f of files) {
+        findings.push(...scanFile(f));
+    }
+    // Re-key console-log to match the union
+    const mapped = findings.map((f) => f.kind === 'console-log' ? { ...f, kind: 'console-log' } : f);
+    const summary = {
+        todo: 0, 'console-log': 0, 'any-type': 0, 'large-file': 0, 'ts-ignore': 0, fixme: 0, hack: 0
+    };
+    for (const f of mapped) {
+        // The todo pattern catches both TODO and FIXME/HACK; reflect into fixme/hack as well when applicable
+        if (f.kind === 'todo') {
+            const lc = f.excerpt.toLowerCase();
+            if (lc.includes('fixme'))
+                summary.fixme++;
+            else if (lc.includes('hack'))
+                summary.hack++;
+            else
+                summary.todo++;
+        }
+        else {
+            summary[f.kind]++;
+        }
+    }
+    const total = Object.values(summary).reduce((s, n) => s + n, 0);
+    const smells = total > 50 ? 'high' : total > 10 ? 'medium' : 'low';
+    return { projectRoot, scannedFiles: files.length, findings: mapped, summary, smells };
+}

package/dist/services/log/log-commands-service.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Service layer for `peaks log tail` and `peaks log ls` subcommands.
+ *
+ * Slice 2026-06-16-cli-logging (G4). Pure helpers that the
+ * commander layer in `src/cli/commands/log-commands.ts` wraps.
+ * Separated from `logger.ts` so the surface is small + testable
+ * without spinning up a Commander program.
+ *
+ * Both helpers default to the on-disk log dir (`resolveLogDir()`)
+ * but accept an `dirOverride` so tests can pin the home to a
+ * tempdir without monkey-patching `os.homedir()`.
+ */
+import { type LogEntry } from './logger.js';
+/**
+ * Return all `peaks-loop-*.log` files in the log dir, sorted by
+ * date descending (newest first). Returns `[]` when the dir is
+ * missing or unreadable. Non-matching entries (e.g. a stray
+ * README) are filtered out.
+ */
+export declare function listLogFiles(opts?: {
+    dirOverride?: string;
+}): string[];
+export type TailLogOptions = {
+    /** Number of trailing lines to return. Defaults to 50. */
+    lines?: number;
+    /** Override the clock for deterministic tests. */
+    now?: () => Date;
+    /** Override the log dir (used by tests). */
+    dirOverride?: string;
+    /** Override the date (PRD AC2: PEAKS_LOG_DATE_OVERRIDE). */
+    dateOverride?: string;
+    /**
+     * Slice 2026-06-23-audit-4th #B2: filter by batchId. When set,
+     * only entries whose `batchId` field matches are returned (and
+     * the trailing-window accounting respects the post-filter total
+     * so a busy day does not push old matching entries out of view).
+     */
+    batchId?: string;
+};
+export type TailLogResult = {
+    /** Absolute path to the file that was tailed, or null when no file exists. */
+    file: string | null;
+    /** The trailing entries (already trimmed to `lines`). */
+    entries: LogEntry[];
+    /** The total number of entries in the file (for header messaging). */
+    total: number;
+    /** When `batchId` filter is applied, the number of matches in the file. */
+    batchMatches?: number;
+};
+/**
+ * Read today's log file and return the last `lines` entries. When
+ * no file exists for the given date, returns `{ file: null, entries: [], total: 0 }`.
+ */
+export declare function tailLog(opts?: TailLogOptions): TailLogResult;

package/dist/services/log/log-commands-service.js

@@ -0,0 +1,83 @@
+/**
+ * Service layer for `peaks log tail` and `peaks log ls` subcommands.
+ *
+ * Slice 2026-06-16-cli-logging (G4). Pure helpers that the
+ * commander layer in `src/cli/commands/log-commands.ts` wraps.
+ * Separated from `logger.ts` so the surface is small + testable
+ * without spinning up a Commander program.
+ *
+ * Both helpers default to the on-disk log dir (`resolveLogDir()`)
+ * but accept an `dirOverride` so tests can pin the home to a
+ * tempdir without monkey-patching `os.homedir()`.
+ */
+import { readdirSync, existsSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { buildLogFileName, readLogEntries, resolveLogDir } from './logger.js';
+const LOG_FILE_NAME_PATTERN = /^peaks-loop-\d{4}-\d{2}-\d{2}\.log$/;
+/**
+ * Return all `peaks-loop-*.log` files in the log dir, sorted by
+ * date descending (newest first). Returns `[]` when the dir is
+ * missing or unreadable. Non-matching entries (e.g. a stray
+ * README) are filtered out.
+ */
+export function listLogFiles(opts = {}) {
+    const logDir = opts.dirOverride ?? resolveLogDir();
+    if (!existsSync(logDir))
+        return [];
+    let names;
+    try {
+        names = readdirSync(logDir);
+    }
+    catch {
+        return [];
+    }
+    return names
+        .filter((name) => LOG_FILE_NAME_PATTERN.test(name))
+        .filter((name) => {
+        try {
+            return statSync(join(logDir, name)).isFile();
+        }
+        catch {
+            return false;
+        }
+    })
+        .sort()
+        .reverse();
+}
+/**
+ * Read today's log file and return the last `lines` entries. When
+ * no file exists for the given date, returns `{ file: null, entries: [], total: 0 }`.
+ */
+export function tailLog(opts = {}) {
+    const lines = opts.lines ?? 50;
+    const logDir = opts.dirOverride ?? resolveLogDir();
+    const now = opts.now ? opts.now() : new Date();
+    const dateForFile = opts.dateOverride !== undefined
+        ? new Date(`${opts.dateOverride}T00:00:00.000Z`)
+        : now;
+    const fileName = buildLogFileName(dateForFile);
+    const fullPath = join(logDir, fileName);
+    const allEntries = readLogEntries({
+        now: () => now,
+        ...(opts.dirOverride !== undefined ? { dirOverride: opts.dirOverride } : {}),
+        ...(opts.dateOverride !== undefined ? { dateOverride: opts.dateOverride } : {})
+    });
+    const total = allEntries.length;
+    if (total === 0) {
+        return { file: null, entries: [], total: 0 };
+    }
+    // Slice 2026-06-23-audit-4th #B2: batchId filter — apply AFTER the
+    // read but BEFORE the trailing window, so a single batch's
+    // interleaved log lines surface as a coherent sequence instead of
+    // being pushed out by sibling-batch lines.
+    const filtered = opts.batchId !== undefined
+        ? allEntries.filter((e) => e.batchId === opts.batchId)
+        : allEntries;
+    if (filtered.length === 0) {
+        return { file: fullPath, entries: [], total, batchMatches: 0 };
+    }
+    const trailing = filtered.slice(Math.max(0, filtered.length - lines));
+    return opts.batchId !== undefined
+        ? { file: fullPath, entries: trailing, total, batchMatches: filtered.length }
+        : { file: fullPath, entries: trailing, total };
+}

package/dist/services/log/logger.d.ts

@@ -0,0 +1,103 @@
+/**
+ * JSONL file logger for peaks-loop.
+ *
+ * Slice 2026-06-16-cli-logging (G1, G2, G5, G6, G7).
+ *
+ * Default-on file logging: every peaks-loop invocation writes a
+ * structured log entry to `<homedir>/.peaks/logs/peaks-loop-YYYY-MM-DD.log`
+ * (UTC date stamp). One JSON object per line.
+ *
+ * Hard contracts enforced here:
+ *  - stdout is NEVER touched by the logger (G7). Use the returned
+ *    `LogLine` string and pipe it to the file only.
+ *  - The log dir is created lazily on first write (G1).
+ *  - File mode is 0o600 on POSIX (R3). Windows uses ACLs and the
+ *    0o600 bit is a no-op there; the call is best-effort.
+ *  - All write paths go through `redact` so a leaked secret can
+ *    never reach disk (G6).
+ *  - The log level can be overridden via `PEAKS_LOG_LEVEL` (G3) and
+ *    `PEAKS_LOG_DATE_OVERRIDE` (AC2) for deterministic tests.
+ *
+ * No third-party deps (R1): `fs.appendFileSync` + `JSON.stringify`
+ * is enough; pino/winston are NOT pulled in.
+ */
+import { dirname } from 'node:path';
+export type LogLevel = 'debug' | 'info' | 'warn' | 'error';
+export type LogEntry = {
+    ts: string;
+    level: LogLevel;
+    command: string;
+    msg: string;
+    sessionId?: string;
+    version?: string;
+    batchId?: string;
+    data?: Record<string, unknown>;
+};
+/**
+ * Returns the canonical log directory. On Windows, `homedir()` is
+ * `%USERPROFILE%`; on macOS / Linux, `$HOME`. The path is the
+ * user-global `~/.peaks/logs/` — never inside a project tree (NG6).
+ */
+export declare function resolveLogDir(): string;
+/**
+ * Returns the UTC date-stamped file name. `date` is injectable so
+ * tests can pin the date without monkey-patching `Date`.
+ */
+export declare function buildLogFileName(date: Date): string;
+export type WriteLogOptions = {
+    /** Override the clock for deterministic tests. Defaults to `new Date()`. */
+    now?: () => Date;
+    /**
+     * Override the log dir for tests. Defaults to `resolveLogDir()`.
+     * Allows the test harness to redirect to a temp dir without
+     * monkey-patching `os.homedir()`.
+     */
+    dirOverride?: string;
+    /**
+     * Override the date used for the file name + entry `ts`. The PRD
+     * AC2 contract is `PEAKS_LOG_DATE_OVERRIDE=YYYY-MM-DD`; the
+     * program-level flag plumbing in `program.ts` reads it and passes
+     * it down. The `now` option still drives the `ts` field, so the
+     * caller MUST pass a matching `Date` for the AC2 invariant.
+     */
+    dateOverride?: string;
+};
+/**
+ * Write a single JSONL log entry. Returns the absolute file path
+ * the entry was written to, or `null` when the entry was filtered
+ * out by the current log level.
+ *
+ * Failures inside the logger (mkdir, appendFile, chmod) are caught
+ * and swallowed: a logger that takes down the CLI is worse than a
+ * logger that drops a line. The swallow is intentional per the PRD
+ * non-goals (NG1: no remote ship; the user only ever sees a file
+ * they read directly).
+ */
+export declare function writeLogEntry(entry: LogEntry, opts?: WriteLogOptions): string | null;
+export type ReadLogOptions = {
+    now?: () => Date;
+    dirOverride?: string;
+    dateOverride?: string;
+};
+/**
+ * Read the current day's log file and return all parseable JSON
+ * entries. Malformed lines are skipped (the on-disk file is JSONL,
+ * but a crash mid-write can leave a partial line; we don't want
+ * that to break `peaks log tail`).
+ */
+export declare function readLogEntries(opts?: ReadLogOptions): LogEntry[];
+/**
+ * Print a log line to stderr IF the current process is in verbose
+ * mode (`--verbose` / `-v` / `PEAKS_LOG_LEVEL=debug`). This is the
+ * G3 opt-in channel: by default, stderr stays clean so the CLI's
+ * `--json` envelope is not contaminated.
+ *
+ * Returns `true` when the line was written; `false` otherwise. The
+ * caller can use the boolean to detect silent-failure patterns (a
+ * `peaks log tail` that prints nothing when the user expected a
+ * verbose stream).
+ */
+export declare function maybeWriteStderr(entry: LogEntry, opts: {
+    verbose: boolean;
+}): boolean;
+export { dirname };

package/dist/services/log/logger.js

@@ -0,0 +1,224 @@
+/**
+ * JSONL file logger for peaks-loop.
+ *
+ * Slice 2026-06-16-cli-logging (G1, G2, G5, G6, G7).
+ *
+ * Default-on file logging: every peaks-loop invocation writes a
+ * structured log entry to `<homedir>/.peaks/logs/peaks-loop-YYYY-MM-DD.log`
+ * (UTC date stamp). One JSON object per line.
+ *
+ * Hard contracts enforced here:
+ *  - stdout is NEVER touched by the logger (G7). Use the returned
+ *    `LogLine` string and pipe it to the file only.
+ *  - The log dir is created lazily on first write (G1).
+ *  - File mode is 0o600 on POSIX (R3). Windows uses ACLs and the
+ *    0o600 bit is a no-op there; the call is best-effort.
+ *  - All write paths go through `redact` so a leaked secret can
+ *    never reach disk (G6).
+ *  - The log level can be overridden via `PEAKS_LOG_LEVEL` (G3) and
+ *    `PEAKS_LOG_DATE_OVERRIDE` (AC2) for deterministic tests.
+ *
+ * No third-party deps (R1): `fs.appendFileSync` + `JSON.stringify`
+ * is enough; pino/winston are NOT pulled in.
+ */
+import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync, chmodSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+import { isSecretKey, redactLine, redactValue } from './redact.js';
+const LEVEL_PRIORITY = {
+    debug: 10,
+    info: 20,
+    warn: 30,
+    error: 40
+};
+/**
+ * Returns the canonical log directory. On Windows, `homedir()` is
+ * `%USERPROFILE%`; on macOS / Linux, `$HOME`. The path is the
+ * user-global `~/.peaks/logs/` — never inside a project tree (NG6).
+ */
+export function resolveLogDir() {
+    return join(homedir(), '.peaks', 'logs');
+}
+/**
+ * Returns the UTC date-stamped file name. `date` is injectable so
+ * tests can pin the date without monkey-patching `Date`.
+ */
+export function buildLogFileName(date) {
+    const yyyy = date.getUTCFullYear().toString().padStart(4, '0');
+    const mm = (date.getUTCMonth() + 1).toString().padStart(2, '0');
+    const dd = date.getUTCDate().toString().padStart(2, '0');
+    return `peaks-loop-${yyyy}-${mm}-${dd}.log`;
+}
+/**
+ * Walk a structured payload and redact any field whose key matches
+ * the secret pattern. Returns a NEW object (immutable). Used by
+ * `writeLogEntry` so a `data` payload containing `apiKey` is never
+ * serialized verbatim.
+ */
+function redactPayload(payload) {
+    if (payload === null || payload === undefined)
+        return payload;
+    if (Array.isArray(payload)) {
+        return payload.map((item) => redactPayload(item));
+    }
+    if (typeof payload === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(payload)) {
+            if (isSecretKey(k)) {
+                out[k] = '<redacted>';
+            }
+            else if (typeof v === 'string') {
+                out[k] = redactValue(v);
+            }
+            else {
+                out[k] = redactPayload(v);
+            }
+        }
+        return out;
+    }
+    if (typeof payload === 'string')
+        return redactValue(payload);
+    return payload;
+}
+function resolveLogLevel() {
+    const env = process.env.PEAKS_LOG_LEVEL?.toLowerCase();
+    if (env === 'debug' || env === 'info' || env === 'warn' || env === 'error') {
+        return env;
+    }
+    return 'info';
+}
+function shouldEmit(level) {
+    const threshold = resolveLogLevel();
+    return LEVEL_PRIORITY[level] >= LEVEL_PRIORITY[threshold];
+}
+/**
+ * Write a single JSONL log entry. Returns the absolute file path
+ * the entry was written to, or `null` when the entry was filtered
+ * out by the current log level.
+ *
+ * Failures inside the logger (mkdir, appendFile, chmod) are caught
+ * and swallowed: a logger that takes down the CLI is worse than a
+ * logger that drops a line. The swallow is intentional per the PRD
+ * non-goals (NG1: no remote ship; the user only ever sees a file
+ * they read directly).
+ */
+export function writeLogEntry(entry, opts = {}) {
+    if (!shouldEmit(entry.level))
+        return null;
+    const now = opts.now ? opts.now() : new Date();
+    const dateForFile = opts.dateOverride !== undefined
+        ? new Date(`${opts.dateOverride}T00:00:00.000Z`)
+        : now;
+    const logDir = opts.dirOverride ?? resolveLogDir();
+    const fileName = buildLogFileName(dateForFile);
+    const fullPath = join(logDir, fileName);
+    try {
+        if (!existsSync(logDir)) {
+            mkdirSync(logDir, { recursive: true });
+        }
+    }
+    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+        return null;
+    }
+    // Build a redacted copy of the entry. We never mutate the caller's
+    // object (immutability rule from coding-style.md).
+    const redactedEntry = {
+        ...entry,
+        ts: entry.ts ?? now.toISOString(),
+        msg: redactLine(entry.msg),
+        ...(entry.sessionId !== undefined ? { sessionId: entry.sessionId } : {}),
+        ...(entry.version !== undefined ? { version: entry.version } : {}),
+        ...(entry.batchId !== undefined ? { batchId: entry.batchId } : {}),
+        ...(entry.data !== undefined ? { data: redactPayload(entry.data) } : {})
+    };
+    let line;
+    try {
+        line = JSON.stringify(redactedEntry);
+    }
+    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+        return null;
+    }
+    try {
+        appendFileSync(fullPath, line + '\n', { mode: 0o600 });
+    }
+    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+        return null;
+    }
+    // `appendFileSync({mode})` only sets the mode when the file is
+    // created. On subsequent writes the mode would not be re-applied
+    // (Node's documented behavior). chmod is a no-op when the mode
+    // is already correct; safe to call.
+    if (process.platform !== 'win32') {
+        try {
+            const stat = statSync(fullPath);
+            if ((stat.mode & 0o777) !== 0o600) {
+                chmodSync(fullPath, 0o600);
+            }
+        }
+        catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+            /* best-effort */
+        }
+    }
+    return fullPath;
+}
+/**
+ * Read the current day's log file and return all parseable JSON
+ * entries. Malformed lines are skipped (the on-disk file is JSONL,
+ * but a crash mid-write can leave a partial line; we don't want
+ * that to break `peaks log tail`).
+ */
+export function readLogEntries(opts = {}) {
+    const now = opts.now ? opts.now() : new Date();
+    const dateForFile = opts.dateOverride !== undefined
+        ? new Date(`${opts.dateOverride}T00:00:00.000Z`)
+        : now;
+    const logDir = opts.dirOverride ?? resolveLogDir();
+    const fileName = buildLogFileName(dateForFile);
+    const fullPath = join(logDir, fileName);
+    if (!existsSync(fullPath))
+        return [];
+    let body;
+    try {
+        body = readFileSync(fullPath, 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const line of body.split('\n')) {
+        if (line.length === 0)
+            continue;
+        try {
+            out.push(JSON.parse(line));
+        }
+        catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+            // skip malformed
+        }
+    }
+    return out;
+}
+/**
+ * Print a log line to stderr IF the current process is in verbose
+ * mode (`--verbose` / `-v` / `PEAKS_LOG_LEVEL=debug`). This is the
+ * G3 opt-in channel: by default, stderr stays clean so the CLI's
+ * `--json` envelope is not contaminated.
+ *
+ * Returns `true` when the line was written; `false` otherwise. The
+ * caller can use the boolean to detect silent-failure patterns (a
+ * `peaks log tail` that prints nothing when the user expected a
+ * verbose stream).
+ */
+export function maybeWriteStderr(entry, opts) {
+    if (!opts.verbose)
+        return false;
+    if (entry.level !== 'debug' && entry.level !== 'info')
+        return false;
+    try {
+        process.stderr.write(JSON.stringify(entry) + '\n');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export { dirname };

package/dist/services/log/redact.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Secret redaction for peaks-loop JSONL log lines.
+ *
+ * Slice 2026-06-16-cli-logging (G6). The logger must NEVER write
+ * a raw secret to disk. We redact at two levels:
+ *  1. Field level — when a structured payload contains a key whose
+ *     name matches a secret pattern (`api_key`, `password`, `token`,
+ *     `Authorization`, etc.), the value is replaced with `<redacted>`.
+ *  2. Line level — when a free-form string contains patterns like
+ *     `Authorization: Bearer <token>`, `api_key=<value>`, or
+ *     `password="<value>"`, the token-shaped value is replaced.
+ *
+ * Redaction is intentionally conservative: false positives are
+ * acceptable (a user can read a redacted line); false negatives are
+ * NOT (a leaked token may be pasted into a GitHub issue).
+ *
+ * The PRD lists the redaction triggers; this module is the only
+ * place the regex table lives, so any future addition (e.g. a new
+ * `client_secret` key) is a one-line change.
+ */
+/**
+ * Returns true when the given key name should be treated as a
+ * secret regardless of the value's shape. Case-insensitive.
+ */
+export declare function isSecretKey(key: unknown): boolean;
+/**
+ * Redact a single string value. Returns the original string when
+ * it does not look like a credential; returns `<redacted>` when it
+ * does. Empty / non-strings return as-is.
+ */
+export declare function redactValue(value: unknown): unknown;
+export declare function redactLine(line: string): string;