sphica 0.5.6 → 0.6.0

package/dist/deliver.js

@@ -21,6 +21,255 @@ import path7 from "node:path";
 
 // server/src/anchors.ts
 import path from "node:path";
+
+// server/src/text.ts
+import crypto from "node:crypto";
+var segmenter = new Intl.Segmenter("ja", { granularity: "word" });
+var HIRAGANA_ONLY = /^[\p{Script=Hiragana}ー]+$/u;
+var STOP = new Set(["the", "a", "an", "of", "to", "in", "is", "and", "or", "for", "on", "it", "be"]);
+var IDENT = /#\d+|[a-z0-9][a-z0-9_./#-]*[a-z0-9]/g;
+var MAX_TERM = 100;
+var OKURIGANA = /^(\p{Script=Han}+)[\p{Script=Hiragana}ー]+$/u;
+function singular(w) {
+  if (!/^[a-z]{4,}$/.test(w))
+    return w;
+  if (w.endsWith("ies"))
+    return `${w.slice(0, -3)}y`;
+  if (w.endsWith("ie"))
+    return `${w.slice(0, -2)}y`;
+  if (/(?:ss|us|x|z|ch|sh)es$/.test(w))
+    return w.slice(0, -2);
+  if (/(?:ch|sh|us)e$/.test(w))
+    return w.slice(0, -1);
+  return w.endsWith("s") && !/(?:ss|us|is)$/.test(w) ? w.slice(0, -1) : w;
+}
+function terms(text) {
+  const norm = text.normalize("NFKC").toLowerCase();
+  const out = [];
+  const keep = (w) => {
+    if (w.length > MAX_TERM || STOP.has(w) || HIRAGANA_ONLY.test(w))
+      return;
+    out.push(OKURIGANA.exec(w)?.[1] ?? singular(w));
+  };
+  for (const s of segmenter.segment(norm))
+    if (s.isWordLike)
+      keep(s.segment.trim());
+  for (const m of norm.matchAll(IDENT))
+    if (m[0].length >= 3)
+      keep(m[0]);
+  return out.filter(Boolean);
+}
+var QUESTION = new Set([
+  ...[
+    "why",
+    "what",
+    "which",
+    "when",
+    "where",
+    "who",
+    "how",
+    "do",
+    "does",
+    "did",
+    "we",
+    "our",
+    "us",
+    "you",
+    "i",
+    "are",
+    "was",
+    "were"
+  ],
+  ...[
+    "will",
+    "would",
+    "should",
+    "can",
+    "could",
+    "there",
+    "this",
+    "that",
+    "with",
+    "from",
+    "any",
+    "ever",
+    "long",
+    "use",
+    "used",
+    "using"
+  ],
+  ...["add", "get", "make", "have", "has", "not", "no", "yes", "reason"],
+  ...["理由", "仕組", "何", "方", "場合", "今", "件"]
+]);
+var sha256 = (s) => crypto.createHash("sha256").update(s).digest();
+function uuidFrom(...parts) {
+  const b = crypto.createHash("sha256").update(parts.join("\x00")).digest().subarray(0, 16);
+  b[6] = (b[6] ?? 0) & 15 | 128;
+  b[8] = (b[8] ?? 0) & 63 | 128;
+  const h = b.toString("hex");
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
+}
+var bytes = (s) => Buffer.byteLength(s, "utf8");
+function head(s, n) {
+  if (bytes(s) <= n)
+    return s;
+  let out = "";
+  let used = 0;
+  for (const ch of s) {
+    const b = bytes(ch);
+    if (used + b > n)
+      break;
+    out += ch;
+    used += b;
+  }
+  return out;
+}
+function tail(s, n) {
+  if (bytes(s) <= n)
+    return s;
+  const chars = [...s];
+  let used = 0;
+  let i = chars.length;
+  while (i > 0) {
+    const b = bytes(chars[i - 1] ?? "");
+    if (used + b > n)
+      break;
+    used += b;
+    i--;
+  }
+  return chars.slice(i).join("");
+}
+var clean = (s) => s.replaceAll("\x00", "");
+var visible = (s) => s.replace(/(?!\p{Join_Control}|\p{Variation_Selector})\p{Default_Ignorable_Code_Point}/gu, "");
+var SECRETS = [
+  [/\bsk-(?:proj-|ant-)?[A-Za-z0-9_-]{20,}/g, "API key"],
+  [/\b[srp]k_(?:live|test)_[A-Za-z0-9]{16,}/g, "API key"],
+  [/\bwhsec_[A-Za-z0-9+/=]{16,}/g, "webhook signing secret"],
+  [/\bpa-[A-Za-z0-9_-]{20,}/g, "API key"],
+  [/\bAIza[0-9A-Za-z_-]{35}/g, "API key"],
+  [/\bnpg_[A-Za-z0-9]{12,}/g, "database password"],
+  [/\bnapi_[A-Za-z0-9]{30,}/g, "API key"],
+  [/\bnpm_[A-Za-z0-9]{36}\b/g, "npm token"],
+  [/\bglpat-[A-Za-z0-9_-]{20,}/g, "GitLab token"],
+  [/\bgh[pousr]_[A-Za-z0-9]{30,}/g, "GitHub token"],
+  [/\bgithub_pat_[A-Za-z0-9_]{40,}/g, "GitHub token"],
+  [/\bxox[abprs]-[A-Za-z0-9-]{10,}/g, "Slack token"],
+  [/https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/]+/g, "Slack webhook"],
+  [/\bAKIA[0-9A-Z]{16}\b/g, "AWS key"],
+  [/(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, "JWT"],
+  [/\b(?:Bearer|BEARER)\s+(?=[A-Za-z0-9._~+/=-]{0,512}\d)[A-Za-z0-9._~+/=-]{16,}/g, "auth header value"]
+];
+var AUTH_HEADER = /(\bAuthorization["']?\s*[:=]\s*(?:["']\s*)?(?:Bearer|Basic|Token|Digest)\s+)[A-Za-z0-9._~+/=-]{8,}/gi;
+var HEADER_BEARER = /(:[ \t]*(?:["'][ \t]*)?bearer[ \t]+)[A-Za-z0-9._~+/=-]{16,}/gi;
+var ENV_ASSIGN = /\b((?:[A-Z][A-Z0-9_]*_)?(?:API|SECRET|MASTER|ENCRYPTION|PRIVATE|ACCESS|SIGNING|AUTH)?KEY|[A-Z][A-Z0-9_]*_(?:PASS|PWD)|(?:[A-Z][A-Z0-9_]*?)?(?:TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIALS?))(\s*=\s*)(?:"(?!\$)[^"\n]+"|'(?!\$)[^'\n]+'|(?![$"'])[^\s"']+)/g;
+var FIELD_NAME = /(?:(?:api|account|access|private|secret)[-_]?key|secret|token|passw(?:or)?d)["']?\s*(?::=|=>|[:=])\s*/gi;
+var MAX_QUOTED = 4096;
+var BARE_HEAD = /[^\s"',;)]{1,256}/y;
+var BARE_REST = /[^\s"',;)]*/y;
+var NEXT_PARAM = /&[A-Za-z_][\w.-]*=/;
+var bareAt = (re, text, at) => {
+  re.lastIndex = at;
+  const v = re.exec(text)?.[0] ?? "";
+  const cut = v.search(NEXT_PARAM);
+  return cut < 0 ? v : v.slice(0, cut);
+};
+function secretValue(quoted, v) {
+  if (v.length < 8 || /^\$(?:\{|[A-Za-z_])/.test(v))
+    return false;
+  if (!quoted)
+    return !/^[#$]/.test(v) && /\d/.test(v) && /[A-Za-z]/.test(v) && !/[()]/.test(v);
+  if (/^#[0-9a-f]{3,8}$/i.test(v) || !/[A-Za-z0-9]/.test(v))
+    return false;
+  return !/\s/.test(v) || v.split(/\s+/).some((w) => /\d/.test(w) && /[A-Za-z]/.test(w));
+}
+function maskFields(text) {
+  let out = "";
+  let last = 0;
+  FIELD_NAME.lastIndex = 0;
+  for (let m = FIELD_NAME.exec(text);m; m = FIELD_NAME.exec(text)) {
+    const at = m.index + m[0].length;
+    const q = text[at];
+    let quote = "";
+    let value;
+    if (q === '"' || q === "'") {
+      const close = text.indexOf(q, at + 1);
+      if (close < 0 || close - at - 1 > MAX_QUOTED)
+        continue;
+      value = text.slice(at + 1, close);
+      if (value.includes(`
+`))
+        continue;
+      quote = q;
+    } else {
+      value = bareAt(BARE_HEAD, text, at);
+    }
+    if (!secretValue(quote !== "", value))
+      continue;
+    if (!quote && value.length === 256)
+      value += bareAt(BARE_REST, text, at + 256);
+    out += `${text.slice(last, at)}${quote}[redacted]`;
+    last = at + quote.length + value.length;
+    FIELD_NAME.lastIndex = last;
+  }
+  return out + text.slice(last);
+}
+var MYSQL_COMMAND = /\bmysql(?:dump|admin)?\b(?:'[^'\n]*'|"[^"\n]*"|[^\n;&|\\'"]|\\\r?\n|\\(?!\r?\n))*/g;
+var MYSQL_PASSWORD = /(\s-p)(?:'[^'\n]*'|"[^"\n]*"|(?=[^\s-])\S+)/;
+var URL_CREDENTIALS = /\b((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|rediss?|amqps?|https?):\/\/[^:\s/@]*:)[^\s/]*@([^@\s/?#]+)/g;
+var KEY_BEGIN = /-----BEGIN [A-Z ]*PRIVATE KEY-----/g;
+var KEY_END = /-----END [A-Z ]*PRIVATE KEY-----/g;
+function keyBlocks(text) {
+  const ends = [...text.matchAll(KEY_END)].map((m) => [m.index, m.index + m[0].length]);
+  const out = [];
+  let last = 0;
+  let e = 0;
+  if (ends.length > 0)
+    for (const m of text.matchAll(KEY_BEGIN)) {
+      const after = m.index + m[0].length;
+      if (m.index < last)
+        continue;
+      while (e < ends.length && (ends[e]?.[0] ?? 0) < after)
+        e++;
+      const end = ends[e];
+      if (!end)
+        break;
+      out.push([m.index, end[1]]);
+      last = end[1];
+    }
+  return out;
+}
+function maskPrivateKeys(text) {
+  let out = "";
+  let last = 0;
+  for (const [a, b] of keyBlocks(text)) {
+    out += `${text.slice(last, a)}[redacted: private key]`;
+    last = b;
+  }
+  return out + text.slice(last);
+}
+function mask(text) {
+  let out = maskFields(maskPrivateKeys(text).replace(URL_CREDENTIALS, "$1[redacted]@$2").replace(AUTH_HEADER, "$1[redacted]").replace(HEADER_BEARER, "$1[redacted]").replace(ENV_ASSIGN, "$1$2[redacted]")).replace(MYSQL_COMMAND, (command) => command.replace(MYSQL_PASSWORD, "$1[redacted]"));
+  for (const [re, what] of SECRETS)
+    out = out.replace(re, `[redacted: ${what}]`);
+  return out;
+}
+var reason = (e) => explain(e, 0) || "unknown failure";
+var plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+function explain(e, depth) {
+  if (!(e instanceof Error)) {
+    try {
+      return String(e);
+    } catch {
+      return "";
+    }
+  }
+  const own = e.message || (e.name === "Error" || e.name === "AggregateError" ? "" : e.name);
+  const parts = depth >= 3 ? [] : [...e instanceof AggregateError ? e.errors : [], ...e.cause === undefined ? [] : [e.cause]];
+  const inner = parts.map((x) => explain(x, depth + 1)).filter(Boolean).join(" / ");
+  return own && inner ? `${own} (${inner})` : own || inner;
+}
+
+// server/src/anchors.ts
 var MAX_BYTES = 2 * 1024 * 1024;
 var leaves = (rel) => rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel);
 
@@ -4154,8 +4403,8 @@ class Deferred {
     this.#resolve?.(value);
     this.#resolve = this.#reject = undefined;
   };
-  reject = (reason) => {
-    this.#reject?.(reason);
+  reject = (reason2) => {
+    this.#reject?.(reason2);
     this.#reject = this.#resolve = undefined;
   };
 }
@@ -4207,9 +4456,9 @@ function assertNotAborted(signal, timing, beforeThrow) {
     throwReasonWithTiming(signal.reason, timing);
   }
 }
-function throwReasonWithTiming(reason, timing) {
-  decorateWithTiming(reason, timing);
-  throw reason;
+function throwReasonWithTiming(reason2, timing) {
+  decorateWithTiming(reason2, timing);
+  throw reason2;
 }
 var ABORTED = {};
 async function waitOrAbort(promise, signal, name, onAbort) {
@@ -4234,11 +4483,11 @@ async function waitOrAbort(promise, signal, name, onAbort) {
   }
 }
 function printBackgroundFail(name) {
-  return (reason) => console.error(`\`${name}\` failed in the background after abortion: ${getMessage(reason)}`);
+  return (reason2) => console.error(`\`${name}\` failed in the background after abortion: ${getMessage(reason2)}`);
 }
-function decorateWithTiming(reason, timing) {
-  if (reason !== null && typeof reason === "object" && !Object.isFrozen(reason)) {
-    Object.defineProperty(reason, "__kysely_timing__", {
+function decorateWithTiming(reason2, timing) {
+  if (reason2 !== null && typeof reason2 === "object" && !Object.isFrozen(reason2)) {
+    Object.defineProperty(reason2, "__kysely_timing__", {
       configurable: true,
       enumerable: false,
       value: timing,
@@ -8163,9 +8412,9 @@ class RuntimeDriver {
     }
     this.#initPromise ??= this.#driver.init(options).then(() => {
       this.#initDone = true;
-    }).catch((reason) => {
+    }).catch((reason2) => {
       this.#initPromise = undefined;
-      throw reason;
+      throw reason2;
     });
     await waitOrAbort(this.#initPromise, options?.signal, "init");
   }
@@ -8226,9 +8475,9 @@ class RuntimeDriver {
       return;
     }
     await waitOrAbort(this.#initPromise, options?.signal, "destroy:initPromise");
-    this.#destroyPromise ??= this.#driver.destroy(options).catch((reason) => {
+    this.#destroyPromise ??= this.#driver.destroy(options).catch((reason2) => {
       this.#destroyPromise = undefined;
-      throw reason;
+      throw reason2;
     });
     await waitOrAbort(this.#destroyPromise, options?.signal, "destroy");
   }
@@ -10837,7 +11086,7 @@ import os from "node:os";
 import path2 from "node:path";
 import { constants as C, DatabaseSync } from "node:sqlite";
 var SCHEMA_GENERATION = 2;
-var SCHEMA_REVISION = 1;
+var SCHEMA_REVISION = 2;
 var sphicaHome = () => process.env.SPHICA_HOME || path2.join(os.homedir(), ".sphica");
 var dbFile = () => process.env.SPHICA_DB || path2.join(sphicaHome(), "sphica.db");
 function requireRuntime() {
@@ -10861,7 +11110,7 @@ function prepare(raw, check) {
   const got = raw.prepare("pragma user_version").get()?.user_version;
   if (got === SCHEMA_REVISION)
     return;
-  throw new Error(`The database schema is revision ${got}, but this Sphica expects revision ${SCHEMA_REVISION}. ` + ((got ?? 0) < SCHEMA_REVISION ? "Move it aside (it is left unchanged), then run `sphica init`." : "Update sphica."));
+  throw new Error(`The database schema is revision ${got}, but this Sphica expects revision ${SCHEMA_REVISION}. ` + ((got ?? 0) < SCHEMA_REVISION ? "Update the sphica CLI (`npm i -g sphica`), then run `sphica init` to migrate it (records are kept)." : "Update sphica."));
 }
 function generationOf(raw) {
   const has = raw.prepare("select 1 from sqlite_schema where type = 'table' and name = 'sphica_generation'").get();
@@ -10959,247 +11208,6 @@ function sqliteCode(e) {
 
 // server/src/db-write.ts
 import { constants as C2, DatabaseSync as DatabaseSync2 } from "node:sqlite";
-
-// server/src/text.ts
-import crypto from "node:crypto";
-var segmenter = new Intl.Segmenter("ja", { granularity: "word" });
-var HIRAGANA_ONLY = /^[\p{Script=Hiragana}ー]+$/u;
-var STOP = new Set(["the", "a", "an", "of", "to", "in", "is", "and", "or", "for", "on", "it", "be"]);
-var IDENT = /#\d+|[a-z0-9][a-z0-9_./#-]*[a-z0-9]/g;
-var MAX_TERM = 100;
-var OKURIGANA = /^(\p{Script=Han}+)[\p{Script=Hiragana}ー]+$/u;
-function singular(w) {
-  if (!/^[a-z]{4,}$/.test(w))
-    return w;
-  if (w.endsWith("ies"))
-    return `${w.slice(0, -3)}y`;
-  if (w.endsWith("ie"))
-    return `${w.slice(0, -2)}y`;
-  if (/(?:ss|us|x|z|ch|sh)es$/.test(w))
-    return w.slice(0, -2);
-  if (/(?:ch|sh|us)e$/.test(w))
-    return w.slice(0, -1);
-  return w.endsWith("s") && !/(?:ss|us|is)$/.test(w) ? w.slice(0, -1) : w;
-}
-function terms(text) {
-  const norm = text.normalize("NFKC").toLowerCase();
-  const out = [];
-  const keep = (w) => {
-    if (w.length > MAX_TERM || STOP.has(w) || HIRAGANA_ONLY.test(w))
-      return;
-    out.push(OKURIGANA.exec(w)?.[1] ?? singular(w));
-  };
-  for (const s of segmenter.segment(norm))
-    if (s.isWordLike)
-      keep(s.segment.trim());
-  for (const m of norm.matchAll(IDENT))
-    if (m[0].length >= 3)
-      keep(m[0]);
-  return out.filter(Boolean);
-}
-var QUESTION = new Set([
-  ...[
-    "why",
-    "what",
-    "which",
-    "when",
-    "where",
-    "who",
-    "how",
-    "do",
-    "does",
-    "did",
-    "we",
-    "our",
-    "us",
-    "you",
-    "i",
-    "are",
-    "was",
-    "were"
-  ],
-  ...[
-    "will",
-    "would",
-    "should",
-    "can",
-    "could",
-    "there",
-    "this",
-    "that",
-    "with",
-    "from",
-    "any",
-    "ever",
-    "long",
-    "use",
-    "used",
-    "using"
-  ],
-  ...["add", "get", "make", "have", "has", "not", "no", "yes", "reason"],
-  ...["理由", "仕組", "何", "方", "場合", "今", "件"]
-]);
-var sha256 = (s) => crypto.createHash("sha256").update(s).digest();
-function uuidFrom(...parts) {
-  const b = crypto.createHash("sha256").update(parts.join("\x00")).digest().subarray(0, 16);
-  b[6] = (b[6] ?? 0) & 15 | 128;
-  b[8] = (b[8] ?? 0) & 63 | 128;
-  const h = b.toString("hex");
-  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
-}
-var bytes = (s) => Buffer.byteLength(s, "utf8");
-function head(s, n) {
-  if (bytes(s) <= n)
-    return s;
-  let out = "";
-  let used = 0;
-  for (const ch of s) {
-    const b = bytes(ch);
-    if (used + b > n)
-      break;
-    out += ch;
-    used += b;
-  }
-  return out;
-}
-function tail(s, n) {
-  if (bytes(s) <= n)
-    return s;
-  const chars = [...s];
-  let used = 0;
-  let i = chars.length;
-  while (i > 0) {
-    const b = bytes(chars[i - 1] ?? "");
-    if (used + b > n)
-      break;
-    used += b;
-    i--;
-  }
-  return chars.slice(i).join("");
-}
-var clean = (s) => s.replaceAll("\x00", "");
-var visible = (s) => s.replace(/(?!\p{Join_Control}|\p{Variation_Selector})\p{Default_Ignorable_Code_Point}/gu, "");
-var SECRETS = [
-  [/\bsk-(?:proj-|ant-)?[A-Za-z0-9_-]{20,}/g, "API key"],
-  [/\b[srp]k_(?:live|test)_[A-Za-z0-9]{16,}/g, "API key"],
-  [/\bwhsec_[A-Za-z0-9+/=]{16,}/g, "webhook signing secret"],
-  [/\bpa-[A-Za-z0-9_-]{20,}/g, "API key"],
-  [/\bAIza[0-9A-Za-z_-]{35}/g, "API key"],
-  [/\bnpg_[A-Za-z0-9]{12,}/g, "database password"],
-  [/\bnapi_[A-Za-z0-9]{30,}/g, "API key"],
-  [/\bnpm_[A-Za-z0-9]{36}\b/g, "npm token"],
-  [/\bglpat-[A-Za-z0-9_-]{20,}/g, "GitLab token"],
-  [/\bgh[pousr]_[A-Za-z0-9]{30,}/g, "GitHub token"],
-  [/\bgithub_pat_[A-Za-z0-9_]{40,}/g, "GitHub token"],
-  [/\bxox[abprs]-[A-Za-z0-9-]{10,}/g, "Slack token"],
-  [/https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/]+/g, "Slack webhook"],
-  [/\bAKIA[0-9A-Z]{16}\b/g, "AWS key"],
-  [/(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, "JWT"],
-  [/\b(?:Bearer|BEARER)\s+(?=[A-Za-z0-9._~+/=-]{0,512}\d)[A-Za-z0-9._~+/=-]{16,}/g, "auth header value"]
-];
-var AUTH_HEADER = /(\bAuthorization["']?\s*[:=]\s*(?:["']\s*)?(?:Bearer|Basic|Token|Digest)\s+)[A-Za-z0-9._~+/=-]{8,}/gi;
-var HEADER_BEARER = /(:[ \t]*(?:["'][ \t]*)?bearer[ \t]+)[A-Za-z0-9._~+/=-]{16,}/gi;
-var ENV_ASSIGN = /\b((?:[A-Z][A-Z0-9_]*_)?(?:API|SECRET|MASTER|ENCRYPTION|PRIVATE|ACCESS|SIGNING|AUTH)?KEY|[A-Z][A-Z0-9_]*_(?:PASS|PWD)|(?:[A-Z][A-Z0-9_]*?)?(?:TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIALS?))(\s*=\s*)(?:"(?!\$)[^"\n]+"|'(?!\$)[^'\n]+'|(?![$"'])[^\s"']+)/g;
-var FIELD_NAME = /(?:(?:api|account|access|private|secret)[-_]?key|secret|token|passw(?:or)?d)["']?\s*(?::=|=>|[:=])\s*/gi;
-var MAX_QUOTED = 4096;
-var BARE_HEAD = /[^\s"',;)]{1,256}/y;
-var BARE_REST = /[^\s"',;)]*/y;
-var NEXT_PARAM = /&[A-Za-z_][\w.-]*=/;
-var bareAt = (re, text, at) => {
-  re.lastIndex = at;
-  const v = re.exec(text)?.[0] ?? "";
-  const cut = v.search(NEXT_PARAM);
-  return cut < 0 ? v : v.slice(0, cut);
-};
-function secretValue(quoted, v) {
-  if (v.length < 8 || /^\$(?:\{|[A-Za-z_])/.test(v))
-    return false;
-  if (!quoted)
-    return !/^[#$]/.test(v) && /\d/.test(v) && /[A-Za-z]/.test(v) && !/[()]/.test(v);
-  if (/^#[0-9a-f]{3,8}$/i.test(v) || !/[A-Za-z0-9]/.test(v))
-    return false;
-  return !/\s/.test(v) || v.split(/\s+/).some((w) => /\d/.test(w) && /[A-Za-z]/.test(w));
-}
-function maskFields(text) {
-  let out = "";
-  let last = 0;
-  FIELD_NAME.lastIndex = 0;
-  for (let m = FIELD_NAME.exec(text);m; m = FIELD_NAME.exec(text)) {
-    const at = m.index + m[0].length;
-    const q = text[at];
-    let quote = "";
-    let value;
-    if (q === '"' || q === "'") {
-      const close = text.indexOf(q, at + 1);
-      if (close < 0 || close - at - 1 > MAX_QUOTED)
-        continue;
-      value = text.slice(at + 1, close);
-      if (value.includes(`
-`))
-        continue;
-      quote = q;
-    } else {
-      value = bareAt(BARE_HEAD, text, at);
-    }
-    if (!secretValue(quote !== "", value))
-      continue;
-    if (!quote && value.length === 256)
-      value += bareAt(BARE_REST, text, at + 256);
-    out += `${text.slice(last, at)}${quote}[redacted]`;
-    last = at + quote.length + value.length;
-    FIELD_NAME.lastIndex = last;
-  }
-  return out + text.slice(last);
-}
-var MYSQL_COMMAND = /\bmysql(?:dump|admin)?\b(?:'[^'\n]*'|"[^"\n]*"|[^\n;&|\\'"]|\\\r?\n|\\(?!\r?\n))*/g;
-var MYSQL_PASSWORD = /(\s-p)(?:'[^'\n]*'|"[^"\n]*"|(?=[^\s-])\S+)/;
-var URL_CREDENTIALS = /\b((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|rediss?|amqps?|https?):\/\/[^:\s/@]*:)[^\s/]*@([^@\s/?#]+)/g;
-var KEY_BEGIN = /-----BEGIN [A-Z ]*PRIVATE KEY-----/g;
-var KEY_END = /-----END [A-Z ]*PRIVATE KEY-----/g;
-function maskPrivateKeys(text) {
-  const ends = [...text.matchAll(KEY_END)].map((m) => [m.index, m.index + m[0].length]);
-  if (ends.length === 0)
-    return text;
-  let out = "";
-  let last = 0;
-  let e = 0;
-  for (const m of text.matchAll(KEY_BEGIN)) {
-    const after = m.index + m[0].length;
-    if (m.index < last)
-      continue;
-    while (e < ends.length && (ends[e]?.[0] ?? 0) < after)
-      e++;
-    const end = ends[e];
-    if (!end)
-      break;
-    out += `${text.slice(last, m.index)}[redacted: private key]`;
-    last = end[1];
-  }
-  return out + text.slice(last);
-}
-function mask(text) {
-  let out = maskFields(maskPrivateKeys(text).replace(URL_CREDENTIALS, "$1[redacted]@$2").replace(AUTH_HEADER, "$1[redacted]").replace(HEADER_BEARER, "$1[redacted]").replace(ENV_ASSIGN, "$1$2[redacted]")).replace(MYSQL_COMMAND, (command) => command.replace(MYSQL_PASSWORD, "$1[redacted]"));
-  for (const [re, what] of SECRETS)
-    out = out.replace(re, `[redacted: ${what}]`);
-  return out;
-}
-var reason = (e) => explain(e, 0) || "unknown failure";
-var plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
-function explain(e, depth) {
-  if (!(e instanceof Error)) {
-    try {
-      return String(e);
-    } catch {
-      return "";
-    }
-  }
-  const own = e.message || (e.name === "Error" || e.name === "AggregateError" ? "" : e.name);
-  const parts = depth >= 3 ? [] : [...e instanceof AggregateError ? e.errors : [], ...e.cause === undefined ? [] : [e.cause]];
-  const inner = parts.map((x) => explain(x, depth + 1)).filter(Boolean).join(" / ");
-  return own && inner ? `${own} (${inner})` : own || inner;
-}
-
-// server/src/db-write.ts
 var ddl = null;
 var DDL = () => ddl ??= new Set([
   "SQLITE_ALTER_TABLE",
@@ -11274,22 +11282,54 @@ function captureAuthorizer(own, action, p1, p2, triggerOrView) {
   return C2.SQLITE_DENY;
 }
 var writes = (action) => action === C2.SQLITE_INSERT || action === C2.SQLITE_UPDATE || action === C2.SQLITE_DELETE;
+var FORGET_ONLY = new Set(["forget_batch", "source_forgotten"]);
+var KEPT_BY_INGEST = new Set(["source", "unit_evidence", "unit_adoption"]);
 function ingestAuthorizer(action, p1, p2) {
   if (DDL().has(action))
     return C2.SQLITE_DENY;
-  if (writes(action) && p1 === "owner_identity")
+  if (writes(action) && (p1 === "owner_identity" || FORGET_ONLY.has(p1 ?? "")))
+    return C2.SQLITE_DENY;
+  if (action === C2.SQLITE_DELETE && KEPT_BY_INGEST.has(p1 ?? ""))
     return C2.SQLITE_DENY;
   if (action === C2.SQLITE_PRAGMA)
     return readsDataVersion(p1, p2) ? C2.SQLITE_OK : C2.SQLITE_DENY;
   return C2.SQLITE_OK;
 }
+var FORGET_WRITES = {
+  [C2.SQLITE_INSERT]: new Set(["forget_batch", "source_forgotten", "unit_state", "source_fts"]),
+  [C2.SQLITE_DELETE]: new Set([
+    "source",
+    "external_reference",
+    "unit_evidence",
+    "unit_adoption",
+    "source_processing",
+    "source_fts"
+  ])
+};
+var FORGET_UPDATES = {
+  unit: new Set(["lifecycle", "revision"]),
+  unit_state: new Set(["source_id"])
+};
+function forgetAuthorizer(action, p1, p2) {
+  if (SHADOW.test(p1 ?? "") && writes(action))
+    return C2.SQLITE_OK;
+  if (action === C2.SQLITE_UPDATE)
+    return FORGET_UPDATES[p1 ?? ""]?.has(p2 ?? "") ? C2.SQLITE_OK : C2.SQLITE_DENY;
+  if (action === C2.SQLITE_INSERT || action === C2.SQLITE_DELETE)
+    return FORGET_WRITES[action]?.has(p1 ?? "") ? C2.SQLITE_OK : C2.SQLITE_DENY;
+  if (action === C2.SQLITE_PRAGMA)
+    return readsDataVersion(p1, p2) || p1 === "secure_delete" && ["on", "1", "true"].includes((p2 ?? "").toLowerCase()) || p1 === "wal_checkpoint" ? C2.SQLITE_OK : C2.SQLITE_DENY;
+  if (action === C2.SQLITE_READ || action === C2.SQLITE_SELECT || action === C2.SQLITE_FUNCTION || action === C2.SQLITE_TRANSACTION || action === C2.SQLITE_SAVEPOINT)
+    return C2.SQLITE_OK;
+  return C2.SQLITE_DENY;
+}
 function connectWriter(role, file = dbFile(), create = false) {
   requireRuntime();
   if (!create)
     requireFile(file);
   const raw = new DatabaseSync2(file);
   try {
-    prepare(raw, create ? "none" : role === "ingest" ? "revision" : "generation");
+    prepare(raw, create ? "none" : role === "ingest" || role === "forget" ? "revision" : "generation");
     raw.function("sphica_terms", { deterministic: true }, (text) => terms(String(text ?? "")).join(" "));
   } catch (e) {
     raw.close();
@@ -11297,6 +11337,8 @@ function connectWriter(role, file = dbFile(), create = false) {
   }
   if (role === "ingest")
     raw.setAuthorizer(ingestAuthorizer);
+  else if (role === "forget")
+    raw.setAuthorizer(forgetAuthorizer);
   else if (role === "capture") {
     let own = false;
     raw.setAuthorizer((action, p1, p2, _db, triggerOrView) => captureAuthorizer(own, action, p1, p2, triggerOrView));