scribeclock 0.0.0-stage → 0.1.0

package/dist/auth/token.js

@@ -0,0 +1,77 @@
+import { authError } from "../cli/errors.js";
+import { refreshTokens, expiresAt } from "./oauth.js";
+/** Access tokens expire after 8 h; refresh this long before that so a call never lands on a dead token. */
+const REFRESH_SKEW_MS = 60 * 1000;
+export class TokenProvider {
+    opts;
+    cached;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    get origin() {
+        if (this.opts.env.SCRIBECLOCK_TOKEN)
+            return "env";
+        return this.cached ? "store" : "none";
+    }
+    async credentials() {
+        if (this.cached !== undefined)
+            return this.cached;
+        this.cached = await this.opts.store.load(this.opts.profile);
+        return this.cached;
+    }
+    now() {
+        return (this.opts.now ?? (() => new Date()))();
+    }
+    isExpiring(creds) {
+        if (!creds.expires_at)
+            return false;
+        return new Date(creds.expires_at).getTime() - this.now().getTime() < REFRESH_SKEW_MS;
+    }
+    async getToken() {
+        const envToken = this.opts.env.SCRIBECLOCK_TOKEN?.trim();
+        if (envToken)
+            return envToken;
+        const creds = await this.credentials();
+        if (!creds)
+            return null;
+        if (creds.kind === "oauth" && creds.refresh_token && this.isExpiring(creds)) {
+            const refreshed = await this.refresh();
+            if (refreshed)
+                return refreshed;
+        }
+        return creds.access_token;
+    }
+    /** Rotating refresh: both tokens are replaced and saved. A reused/revoked refresh token logs out. */
+    async refresh() {
+        if (this.opts.env.SCRIBECLOCK_TOKEN)
+            return null;
+        const creds = await this.credentials();
+        if (!creds || creds.kind !== "oauth" || !creds.refresh_token || !creds.token_endpoint)
+            return null;
+        const result = await refreshTokens(this.opts.fetch, creds.token_endpoint, creds.refresh_token, creds.client_id);
+        if (!result.ok) {
+            if (result.error === "invalid_grant" || result.error === "invalid_client") {
+                await this.opts.store.clear(this.opts.profile);
+                this.cached = null;
+                throw authError("Your ScribeClock session was revoked or expired.", "Run `scribeclock login` to sign in again.");
+            }
+            return null;
+        }
+        const next = {
+            ...creds,
+            access_token: result.tokens.access_token,
+            refresh_token: result.tokens.refresh_token ?? creds.refresh_token,
+            expires_at: expiresAt(result.tokens.expires_in, this.now()),
+            scopes: result.tokens.scope ? result.tokens.scope.split(/\s+/).filter(Boolean) : creds.scopes,
+            saved_at: this.now().toISOString(),
+        };
+        await this.opts.store.save(this.opts.profile, next);
+        this.cached = next;
+        this.opts.onRefreshed?.(next);
+        return next.access_token;
+    }
+    /** Forget the in-memory copy (after login/logout). */
+    invalidate() {
+        this.cached = undefined;
+    }
+}

package/dist/cli/confirm.js

@@ -0,0 +1,73 @@
+import { createInterface } from "node:readline";
+import { CliError } from "./errors.js";
+/**
+ * Asks before anything destructive or sensitive. `--yes` answers for the person; without a terminal
+ * the command refuses instead of hanging or guessing.
+ */
+export async function confirm(ctx, question, opts = {}) {
+    if (ctx.flags.yes)
+        return true;
+    if (!ctx.stdin.isTTY || !ctx.out.isTTY || ctx.flags.json) {
+        throw new CliError(`${question.replace(/\?\s*$/, "")} — this needs confirmation and no interactive terminal is attached.`, {
+            id: "confirmation_required",
+            hint: "Re-run with --yes to confirm, or --dry-run to see what would happen.",
+        });
+    }
+    const label = opts.danger ? ctx.out.red(question) : question;
+    const answer = await ask(ctx, `${label} ${ctx.out.dim("[y/N]")} `);
+    return /^y(es)?$/i.test(answer.trim());
+}
+/**
+ * Reads a secret from the terminal without echoing it (raw mode; Backspace edits, Ctrl-C aborts).
+ * Falls back to a normal read when stdin is not a TTY.
+ */
+export function askHidden(ctx, prompt) {
+    const input = ctx.stdin.stream;
+    if (typeof input.setRawMode !== "function" || !ctx.stdin.isTTY)
+        return ask(ctx, prompt);
+    return new Promise((resolve, reject) => {
+        ctx.out.stderr.write(prompt);
+        const wasRaw = Boolean(input.isRaw);
+        input.setRawMode(true);
+        input.resume();
+        input.setEncoding("utf8");
+        let value = "";
+        const done = (err) => {
+            input.removeListener("data", onData);
+            input.setRawMode(wasRaw);
+            input.pause();
+            ctx.out.stderr.write("\n");
+            if (err)
+                reject(err);
+            else
+                resolve(value);
+        };
+        const onData = (chunk) => {
+            for (const ch of chunk) {
+                if (ch === "\u0003")
+                    return done(new CliError("Cancelled.", { id: "cancelled" }));
+                if (ch === "\r" || ch === "\n")
+                    return done();
+                if (ch === "\u007f" || ch === "\b")
+                    value = value.slice(0, -1);
+                else if (ch >= " ")
+                    value += ch;
+            }
+        };
+        input.on("data", onData);
+    });
+}
+export function ask(ctx, prompt) {
+    return new Promise((resolve) => {
+        const rl = createInterface({ input: ctx.stdin.stream, output: ctx.out.stderr, terminal: true });
+        rl.question(prompt, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
+/** Describes a planned call for --dry-run output and confirmation prompts, with secrets masked. */
+export function describeCall(tool, args, mask) {
+    const shown = mask(args);
+    return `${tool} ${JSON.stringify(shown)}`;
+}

package/dist/cli/errors.js

@@ -0,0 +1,48 @@
+import { EXIT } from "../types.js";
+export class CliError extends Error {
+    code;
+    hint;
+    id;
+    details;
+    constructor(message, options = {}) {
+        super(message);
+        this.name = "CliError";
+        this.code = options.code ?? EXIT.ERROR;
+        this.hint = options.hint;
+        this.id = options.id ?? defaultId(this.code);
+        this.details = options.details;
+    }
+}
+function defaultId(code) {
+    switch (code) {
+        case EXIT.USAGE:
+            return "usage";
+        case EXIT.AUTH:
+            return "not_authenticated";
+        case EXIT.CONFLICT:
+            return "conflict";
+        case EXIT.SCOPE:
+            return "insufficient_scope";
+        default:
+            return "error";
+    }
+}
+export function usageError(message, hint) {
+    return new CliError(message, { code: EXIT.USAGE, hint, id: "usage" });
+}
+export function authError(message = "You are not logged in.", hint = "Run `scribeclock login`, or set SCRIBECLOCK_TOKEN to a personal access token.") {
+    return new CliError(message, { code: EXIT.AUTH, hint, id: "not_authenticated" });
+}
+export function scopeError(required, granted) {
+    const need = required ?? "an additional";
+    const want = Array.from(new Set([...(granted ?? []), ...(required ? [required] : [])])).join(",");
+    return new CliError(`This token does not include the ${need} scope.`, {
+        code: EXIT.SCOPE,
+        id: "insufficient_scope",
+        hint: `Log in again with that permission: scribeclock login --scopes ${want || "<scopes>"} (or create a personal access token with it at https://scribeclock.com/dashboard/settings/ai-agents).`,
+        details: { required_scope: required, granted_scopes: granted },
+    });
+}
+export function isCliError(e) {
+    return e instanceof CliError || (typeof e === "object" && e !== null && e.name === "CliError");
+}

package/dist/cli/output.js

@@ -0,0 +1,185 @@
+/** Tokens never reach a terminal or a log: anything shaped like one is replaced before writing. */
+const TOKEN_PATTERN = /scmcp_(?:[a-z]_)?[A-Za-z0-9_-]{8,}/g;
+export function scrubTokens(text) {
+    return text.replace(TOKEN_PATTERN, (m) => `${m.slice(0, 6)}••••`);
+}
+export class Output {
+    stdout;
+    stderr;
+    color;
+    quiet;
+    json;
+    isTTY;
+    constructor(opts = {}) {
+        this.stdout = opts.stdout ?? process.stdout;
+        this.stderr = opts.stderr ?? process.stderr;
+        const env = opts.env ?? process.env;
+        this.isTTY = Boolean(this.stdout.isTTY);
+        this.quiet = Boolean(opts.quiet);
+        this.json = Boolean(opts.json);
+        if (opts.color === false)
+            this.color = false;
+        else if (opts.color === true)
+            this.color = true;
+        else if ("NO_COLOR" in env && env.NO_COLOR !== "")
+            this.color = false;
+        else if (env.FORCE_COLOR && env.FORCE_COLOR !== "0")
+            this.color = true;
+        else
+            this.color = this.isTTY && env.TERM !== "dumb";
+    }
+    /** Main result text (stdout). */
+    log(text = "") {
+        this.stdout.write(scrubTokens(text) + "\n");
+    }
+    /** Raw stdout write without a trailing newline (progress, prompts). */
+    write(text) {
+        this.stdout.write(scrubTokens(text));
+    }
+    /** Secondary information (stderr), hidden with --quiet. */
+    info(text) {
+        if (this.quiet)
+            return;
+        this.stderr.write(scrubTokens(text) + "\n");
+    }
+    warn(text) {
+        this.stderr.write(scrubTokens(this.yellow("warning: ") + text) + "\n");
+    }
+    error(text) {
+        this.stderr.write(scrubTokens(this.red("error: ") + text) + "\n");
+    }
+    jsonOut(value) {
+        this.stdout.write(scrubTokens(JSON.stringify(value, null, 2)) + "\n");
+    }
+    /** NDJSON line (one object per line) for pipes. */
+    ndjson(value) {
+        this.stdout.write(scrubTokens(JSON.stringify(value)) + "\n");
+    }
+    paint(code, text) {
+        return this.color ? `\u001b[${code}m${text}\u001b[0m` : text;
+    }
+    bold(t) {
+        return this.paint("1", t);
+    }
+    dim(t) {
+        return this.paint("2", t);
+    }
+    red(t) {
+        return this.paint("31", t);
+    }
+    green(t) {
+        return this.paint("32", t);
+    }
+    yellow(t) {
+        return this.paint("33", t);
+    }
+    blue(t) {
+        return this.paint("34", t);
+    }
+    magenta(t) {
+        return this.paint("35", t);
+    }
+    cyan(t) {
+        return this.paint("36", t);
+    }
+    heading(text) {
+        this.log(this.bold(text));
+    }
+    /** Two-column key/value block; empty values are skipped. */
+    kv(pairs, indent = 2) {
+        const shown = pairs.filter(([, v]) => v !== undefined && v !== null && v !== "");
+        const width = Math.max(0, ...shown.map(([k]) => k.length));
+        for (const [k, v] of shown) {
+            this.log(`${" ".repeat(indent)}${this.dim(k.padEnd(width))}  ${formatCell(v)}`);
+        }
+    }
+    /** Aligned table. Cells are stringified; long cells are truncated to keep rows on one line. */
+    table(headers, rows, opts = {}) {
+        const indent = " ".repeat(opts.indent ?? 0);
+        const termWidth = this.stdout.columns ?? 120;
+        const maxWidth = opts.maxWidth ?? Math.max(24, Math.min(64, Math.floor(termWidth / Math.max(1, headers.length)) - 2));
+        const cells = rows.map((r) => r.map((c) => truncate(formatCell(c), maxWidth)));
+        const widths = headers.map((h, i) => Math.max(visibleLength(h), ...cells.map((r) => visibleLength(r[i] ?? ""))));
+        const line = (cols) => indent + cols.map((c, i) => padEnd(c ?? "", widths[i])).join("  ").trimEnd();
+        this.log(this.dim(line(headers)));
+        for (const r of cells)
+            this.log(line(r));
+    }
+}
+export function formatCell(v) {
+    if (v === null || v === undefined)
+        return "";
+    if (typeof v === "string")
+        return v;
+    if (typeof v === "number" || typeof v === "boolean")
+        return String(v);
+    if (v instanceof Date)
+        return v.toISOString();
+    if (Array.isArray(v))
+        return v.map(formatCell).join(", ");
+    return JSON.stringify(v);
+}
+const ANSI = /\u001b\[[0-9;]*m/g;
+export function visibleLength(s) {
+    return s.replace(ANSI, "").length;
+}
+export function padEnd(s, width) {
+    const pad = width - visibleLength(s);
+    return pad > 0 ? s + " ".repeat(pad) : s;
+}
+export function truncate(s, max) {
+    const flat = s.replace(/\s+/g, " ");
+    return visibleLength(flat) <= max ? flat : flat.slice(0, Math.max(0, max - 1)) + "…";
+}
+/** Replace secret-looking values in a vault result unless the person asked to reveal them. */
+const SECRET_KEYS = /^(password|secret|value|access_token|refresh_token|client_secret|api_key|apikey|private_key|token)$/i;
+export function maskSecrets(value, reveal = false) {
+    if (reveal)
+        return value;
+    const walk = (v) => {
+        if (Array.isArray(v))
+            return v.map((x) => walk(x));
+        if (v && typeof v === "object") {
+            const out = {};
+            for (const [k, val] of Object.entries(v)) {
+                if (typeof val === "string" && SECRET_KEYS.test(k))
+                    out[k] = mask(val);
+                else if (k === "env" || k === "dotenv" || k === "env_text")
+                    out[k] = typeof val === "string" ? maskDotenv(val) : walk(val);
+                else if (k === "map" || k === "values" || k === "variables")
+                    out[k] = maskMap(val);
+                else
+                    out[k] = walk(val);
+            }
+            return out;
+        }
+        return v;
+    };
+    return walk(value);
+}
+export function mask(value) {
+    if (!value)
+        return value;
+    return "••••" + (value.length > 8 ? value.slice(-2) : "");
+}
+function maskMap(v) {
+    if (!v || typeof v !== "object" || Array.isArray(v))
+        return v;
+    const out = {};
+    for (const [k, val] of Object.entries(v))
+        out[k] = typeof val === "string" ? mask(val) : val;
+    return out;
+}
+/** KEY=value lines → KEY=•••• (comments and blank lines untouched). */
+export function maskDotenv(text) {
+    return text
+        .split("\n")
+        .map((line) => {
+        const m = /^(\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*\s*=)(.*)$/.exec(line);
+        if (!m)
+            return line;
+        const value = m[2].trim().replace(/^["']|["']$/g, "");
+        return `${m[1]}${value ? mask(value) : ""}`;
+    })
+        .join("\n");
+}

package/dist/cli/parser.js

@@ -0,0 +1,230 @@
+import { usageError } from "./errors.js";
+/**
+ * Pulls the global flags out of argv wherever they appear and leaves everything else (command
+ * words, positionals and command-specific flags) in order. Tokens after `--` are passthrough.
+ */
+export function parseGlobals(argv) {
+    const flags = {
+        json: false,
+        yes: false,
+        dryRun: false,
+        debug: false,
+        color: null,
+        quiet: false,
+        help: false,
+        version: false,
+        reveal: false,
+    };
+    const rest = [];
+    const passthrough = [];
+    for (let i = 0; i < argv.length; i++) {
+        const t = argv[i];
+        if (t === "--") {
+            passthrough.push(...argv.slice(i + 1));
+            break;
+        }
+        const eq = t.indexOf("=");
+        const name = t.startsWith("--") && eq > 0 ? t.slice(0, eq) : t;
+        const inlineValue = t.startsWith("--") && eq > 0 ? t.slice(eq + 1) : undefined;
+        const takeValue = () => {
+            if (inlineValue !== undefined)
+                return inlineValue;
+            const next = argv[i + 1];
+            if (next === undefined || (next.startsWith("-") && next.length > 1))
+                throw usageError(`${name} needs a value.`);
+            i++;
+            return next;
+        };
+        switch (name) {
+            case "--json": {
+                // `call <tool> --json '{...}'` passes INPUT json; leave it for the command.
+                const next = argv[i + 1];
+                if (inlineValue === undefined && next && /^\s*[[{]/.test(next)) {
+                    rest.push(t);
+                    break;
+                }
+                flags.json = true;
+                break;
+            }
+            case "--org":
+                flags.org = takeValue();
+                break;
+            case "--url":
+                flags.url = takeValue();
+                break;
+            case "-y":
+            case "--yes":
+                flags.yes = true;
+                break;
+            case "--dry-run":
+                flags.dryRun = true;
+                break;
+            case "--debug":
+                flags.debug = true;
+                break;
+            case "--no-color":
+                flags.color = false;
+                break;
+            case "--color":
+                flags.color = true;
+                break;
+            case "-q":
+            case "--quiet":
+                flags.quiet = true;
+                break;
+            case "-h":
+            case "--help":
+                flags.help = true;
+                break;
+            case "-V":
+            case "--version":
+                flags.version = true;
+                break;
+            case "--reveal":
+                flags.reveal = true;
+                break;
+            default:
+                rest.push(t);
+        }
+    }
+    return { flags, rest, passthrough };
+}
+/** Parses a built-in command's own flags. Unknown flags are an error unless allowUnknown is set. */
+export function parseFlags(tokens, specs, opts = {}) {
+    const flags = {};
+    const positionals = [];
+    const unknown = [];
+    const byName = new Map();
+    for (const s of specs) {
+        byName.set(`--${s.name}`, s);
+        if (s.alias)
+            byName.set(`-${s.alias}`, s);
+        if (s.default !== undefined)
+            flags[s.name] = s.default;
+    }
+    for (let i = 0; i < tokens.length; i++) {
+        const t = tokens[i];
+        if (!t.startsWith("-") || t === "-") {
+            positionals.push(t);
+            continue;
+        }
+        const eq = t.startsWith("--") ? t.indexOf("=") : -1;
+        const key = eq > 0 ? t.slice(0, eq) : t;
+        const inline = eq > 0 ? t.slice(eq + 1) : undefined;
+        let spec = byName.get(key);
+        let negated = false;
+        if (!spec && key.startsWith("--no-")) {
+            spec = byName.get(`--${key.slice(5)}`);
+            negated = Boolean(spec && spec.type === "boolean");
+            if (!negated)
+                spec = undefined;
+        }
+        if (!spec) {
+            if (!opts.allowUnknown) {
+                const suggestion = closest(key.replace(/^-+/, ""), specs.map((s) => s.name));
+                throw usageError(`Unknown option ${key}.`, suggestion ? `Did you mean --${suggestion}?` : "Run with --help to see the options.");
+            }
+            unknown.push(t);
+            const next = tokens[i + 1];
+            if (inline === undefined && next !== undefined && !next.startsWith("-")) {
+                unknown.push(next);
+                i++;
+            }
+            continue;
+        }
+        if (spec.type === "boolean") {
+            if (inline !== undefined)
+                flags[spec.name] = parseBool(inline, spec.name);
+            else
+                flags[spec.name] = !negated;
+            continue;
+        }
+        let value = inline;
+        if (value === undefined) {
+            const next = tokens[i + 1];
+            if (next === undefined || (next.startsWith("--") && next.length > 2))
+                throw usageError(`--${spec.name} needs a value.`);
+            value = next;
+            i++;
+        }
+        if (spec.choices && !spec.choices.includes(value)) {
+            throw usageError(`--${spec.name} must be one of: ${spec.choices.join(", ")} (got "${value}").`);
+        }
+        if (spec.type === "number") {
+            const n = Number(value);
+            if (!Number.isFinite(n))
+                throw usageError(`--${spec.name} must be a number (got "${value}").`);
+            flags[spec.name] = n;
+        }
+        else if (spec.type === "array") {
+            const prev = Array.isArray(flags[spec.name]) ? flags[spec.name] : [];
+            flags[spec.name] = [...prev, ...splitList(value)];
+        }
+        else {
+            flags[spec.name] = value;
+        }
+    }
+    for (const s of specs) {
+        if (s.required && flags[s.name] === undefined)
+            throw usageError(`--${s.name} is required.`, s.description);
+    }
+    return { flags, positionals, unknown };
+}
+export function parseBool(value, name) {
+    const v = value.trim().toLowerCase();
+    if (["true", "yes", "y", "1", "on"].includes(v))
+        return true;
+    if (["false", "no", "n", "0", "off"].includes(v))
+        return false;
+    throw usageError(`${name} expects true or false (got "${value}").`);
+}
+export function splitList(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith("[")) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (Array.isArray(parsed))
+                return parsed.map(String);
+        }
+        catch {
+            /* fall through to comma split */
+        }
+    }
+    return trimmed
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+/** Nearest candidate by a cheap edit distance, for "did you mean" hints. */
+export function closest(input, candidates, max = 3) {
+    let best;
+    let bestD = Infinity;
+    for (const c of candidates) {
+        const d = levenshtein(input.toLowerCase(), c.toLowerCase());
+        if (d < bestD) {
+            bestD = d;
+            best = c;
+        }
+    }
+    if (best && bestD <= max)
+        return best;
+    const sub = candidates.find((c) => c.toLowerCase().includes(input.toLowerCase()) || input.toLowerCase().includes(c.toLowerCase()));
+    return sub;
+}
+export function levenshtein(a, b) {
+    const m = a.length;
+    const n = b.length;
+    if (!m)
+        return n;
+    if (!n)
+        return m;
+    let prev = Array.from({ length: n + 1 }, (_, j) => j);
+    for (let i = 1; i <= m; i++) {
+        const cur = [i];
+        for (let j = 1; j <= n; j++) {
+            cur[j] = Math.min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+        }
+        prev = cur;
+    }
+    return prev[n];
+}

package/dist/cli/policy.js

@@ -0,0 +1,49 @@
+const CF_WRITE = new Set(["cloudflare_dns_upsert", "cloudflare_dns_delete", "cloudflare_purge_cache"]);
+const VAULT_SENSITIVE = new Set(["vault_get_env", "vault_put_env", "vault_put_credential", "vault_delete_secret"]);
+/**
+ * Which tools need a confirmation and masking. Names come first (the catalog may grow, so new
+ * `delete_*` / `vault_*` / `cloudflare_*` tools are covered automatically); annotations are the
+ * fallback for anything else the server marks destructive.
+ */
+export function sensitivity(name, def, args = {}) {
+    if (name === "delete_organization_file") {
+        return { confirm: true, reason: "permanently deletes a file", maskOutput: false, maskArgs: false, serverDryRun: { flag: "confirm" } };
+    }
+    if (/^delete_/.test(name))
+        return { confirm: true, reason: "deletes data", maskOutput: false, maskArgs: false };
+    if (VAULT_SENSITIVE.has(name) || (/^vault_/.test(name) && name !== "vault_list_secrets")) {
+        const reads = name === "vault_get_env";
+        return { confirm: true, reason: reads ? "reads vault values (audited)" : name.includes("delete") ? "wipes a vault secret" : "writes vault secrets", maskOutput: true, maskArgs: !reads };
+    }
+    if (CF_WRITE.has(name))
+        return { confirm: true, reason: "changes Cloudflare live", maskOutput: false, maskArgs: false };
+    if (name === "cloudflare_request") {
+        const method = String(args.method ?? "GET").toUpperCase();
+        const write = !["GET", "HEAD"].includes(method);
+        return { confirm: write, reason: write ? `sends a live ${method} to the Cloudflare API` : undefined, maskOutput: false, maskArgs: false };
+    }
+    if (/^cloudflare_dns_/.test(name))
+        return { confirm: true, reason: "changes DNS live", maskOutput: false, maskArgs: false };
+    const a = def?.annotations;
+    if (a && a.destructiveHint === true && a.readOnlyHint !== true && a.openWorldHint === true) {
+        return { confirm: true, reason: "changes an external system", maskOutput: false, maskArgs: false };
+    }
+    return { confirm: false, maskOutput: false, maskArgs: false };
+}
+export function isReadOnly(def) {
+    return def?.annotations?.readOnlyHint === true;
+}
+const ARG_SECRET_KEYS = /^(password|secret|value|dotenv|content|content_base64|token|api_key)$/i;
+/** Hide secret-looking argument values when a call is echoed. */
+export function maskArgs(args) {
+    const out = {};
+    for (const [k, v] of Object.entries(args)) {
+        if (typeof v === "string" && ARG_SECRET_KEYS.test(k))
+            out[k] = `<${v.length} chars>`;
+        else if (k === "entries" && Array.isArray(v))
+            out[k] = v.map((e) => (e && typeof e === "object" ? { ...e, value: "<hidden>" } : e));
+        else
+            out[k] = v;
+    }
+    return out;
+}