{"version":3,"sources":["../src/safety/sensitive-key.ts","../src/logs/redactor.ts"],"names":[],"mappings":";;;;;AAYA,SAAS,wBAAwB,KAAA,EAAwB;AACvD,EAAA,OAAO,QAAA,CAAS,KAAK,KAAK,CAAA;AAC5B;AAOO,SAAS,sBAAsB,KAAA,EAAuB;AAC3D,EAAA,OAAO,KAAA,CACJ,OAAA,CAAQ,oBAAA,EAAsB,OAAO,CAAA,CACrC,WAAA,EAAY,CACZ,OAAA,CAAQ,aAAA,EAAe,GAAG,CAAA,CAC1B,OAAA,CAAQ,YAAY,EAAE,CAAA;AAC3B;AAGO,IAAM,mCAAwD,IAAI,GAAA;AAAA,EACvE;AAAA,IACE,QAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA;AAAA,IACA,eAAA;AAAA,IACA,aAAA;AAAA,IACA,aAAA;AAAA,IACA,cAAA;AAAA,IACA,cAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,eAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACF,CAAE,IAAI,qBAAqB;AAC7B,CAAA;AAEO,IAAM,iCAAA,GAAoC;AAAA,EAC/C,eAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,eAAA;AAAA,EACA,cAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF;AAEA,SAAS,qBAAqB,UAAA,EAA6B;AACzD,EAAA,IAAI,gCAAA,CAAiC,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,KAAA;AAC7D,EAAA,IAAI,UAAA,KAAe,SAAS,OAAO,IAAA;AAEnC,EAAA,IAAI,UAAA,CAAW,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,KAAA;AAC1C,EAAA,OAAO,UAAA,CAAW,SAAS,OAAO,CAAA;AACpC;AAUO,SAAS,wBAAA,CACd,GAAA,EACA,aAAA,GAAmC,iCAAA,EAC1B;AACT,EAAA,IAAI,CAAC,KAAK,OAAO,KAAA;AACjB,EAAA,MAAM,UAAA,GAAa,sBAAsB,GAAG,CAAA;AAC5C,EAAA,IAAI,CAAC,YAAY,OAAO,KAAA;AACxB,EAAA,IAAI,gCAAA,CAAiC,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,KAAA;AAE7D,EAAA,MAAM,mBAAA,GAAsB,wBAAwB,GAAG,CAAA;AAEvD,EAAA,KAAA,MAAW,aAAa,aAAA,EAAe;AACrC,IAAA,MAAM,CAAA,GAAI,sBAAsB,SAAS,CAAA;AACzC,IAAA,IAAI,CAAC,CAAA,EAAG;AACR,IAAA,IAAI,MAAM,OAAA,EAAS;AACjB,MAAA,IAAI,oBAAA,CAAqB,UAAU,CAAA,EAAG,OAAO,IAAA;AAC7C,MAAA;AAAA,IACF;AACA,IAAA,IAAI,UAAA,KAAe,GAAG,OAAO,IAAA;AAE7B,IAAA,IAAI,WAAW,QAAA,CAAS,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,GAAG,OAAO,IAAA;AACzC,IAAA,IAAI,uBAAuB,UAAA,CAAW,UAAA,CAAW,GAAG,CAAC,CAAA,CAAA,CAAG,GAAG,OAAO,IAAA;AAAA,EACpE;AACA,EAAA,OAAO,KAAA;AACT;;;ACzGO,IAAM,mBAAA,GAAsB;AAAA,EACjC,eAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF;AAQA,SAAS,SAAS,CAAA,EAA0C;AAC1D,EAAA,OAAO,OAAO,MAAM,QAAA,IAAY,CAAA,KAAM,QAAQ,CAAC,KAAA,CAAM,QAAQ,CAAC,CAAA;AAChE;AAEA,SAAS,MAAM,CAAA,EAAmB;AAChC,EAAA,OAAO,EAAE,WAAA,EAAY;AACvB;AAEA,SAAS,WAAW,KAAA,EAAuB;AACzC,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,OAAO,KAAA,EAAO,MAAM,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AACxE,EAAA,OAAO,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AACrB;AAQA,SAAS,YAAA,CACP,OACA,SAAA,EACgB;AAChB,EAAA,MAAM,GAAA,uBAAU,GAAA,EAA0B;AAE1C,EAAA,MAAM,GAAA,GAAM,CAAC,CAAA,KAAoB;AAC/B,IAAA,MAAM,CAAA,GAAI,KAAA,CAAM,CAAA,CAAE,GAAG,CAAA;AACrB,IAAA,GAAA,CAAI,GAAA,CAAI,CAAA,EAAG,EAAE,GAAG,CAAA,EAAG,GAAA,EAAK,CAAA,EAAG,GAAA,EAAK,CAAA,CAAE,GAAA,IAAO,CAAA,CAAE,GAAA,EAAqB,CAAA;AAAA,EAClE,CAAA;AAEA,EAAA,KAAA,MAAW,KAAK,mBAAA,EAAqB;AACnC,IAAA,GAAA,CAAI,EAAE,GAAA,EAAK,CAAA,EAAG,QAAA,EAAU,QAAQ,CAAA;AAAA,EAClC;AAEA,EAAA,KAAA,MAAW,CAAA,IAAK,SAAA,IAAa,EAAC,EAAG;AAC/B,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,SAAS,CAAA,EAAG;AACzC,MAAA,GAAA,CAAI,EAAE,GAAA,EAAK,CAAA,EAAG,QAAA,EAAU,QAAQ,CAAA;AAAA,IAClC;AAAA,EACF;AAEA,EAAA,KAAA,MAAW,CAAA,IAAK,KAAA,IAAS,EAAC,EAAG;AAC3B,IAAA,IAAI,OAAO,MAAM,QAAA,EAAU;AACzB,MAAA,GAAA,CAAI,EAAE,GAAA,EAAK,CAAA,EAAG,QAAA,EAAU,QAAQ,CAAA;AAChC,MAAA;AAAA,IACF;AACA,IAAA,MAAM,MAAM,CAAA,CAAE,GAAA;AACd,IAAA,IAAI,CAAA,CAAE,aAAa,MAAA,EAAQ,GAAA,CAAI,EAAE,GAAA,EAAK,QAAA,EAAU,QAAQ,CAAA;AACxD,IAAA,IAAI,CAAA,CAAE,aAAa,MAAA,EAAQ,GAAA,CAAI,EAAE,GAAA,EAAK,QAAA,EAAU,QAAQ,CAAA;AACxD,IAAA,IAAI,CAAA,CAAE,aAAa,QAAA,EAAU;AAC3B,MAAA,GAAA,CAAI,EAAE,GAAA,EAAK,QAAA,EAAU,QAAA,EAAU,IAAA,EAAM,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,GAAW,CAAA,CAAE,IAAA,GAAO,CAAA,EAAG,CAAA;AAAA,IAChF;AAAA,EACF;AAEA,EAAA,OAAO,CAAC,GAAG,GAAA,CAAI,MAAA,EAAQ,CAAA;AACzB;AAEO,IAAM,WAAN,MAAe;AAAA,EACX,MAAA;AAAA,EAET,YAAY,OAAA,EAA2B;AACrC,IAAA,IAAA,CAAK,MAAA,GAAS,YAAA,CAAa,OAAA,EAAS,KAAA,EAAO,SAAS,SAAS,CAAA;AAAA,EAC/D;AAAA;AAAA,EAGA,IAAI,aAAA,GAAmC;AACrC,IAAA,OAAO,IAAA,CAAK,OAAO,GAAA,CAAI,CAAC,SAAS,IAAA,CAAK,GAAA,IAAO,KAAK,GAAG,CAAA;AAAA,EACvD;AAAA,EAEA,WAAA,CAAY,KAAa,KAAA,EAAyB;AAChD,IAAA,MAAM,CAAA,GAAI,MAAM,GAAG,CAAA;AACnB,IAAA,MAAM,IAAA,GACJ,KAAK,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,KAAQ,CAAC,CAAA,IACnC,IAAA,CAAK,OAAO,IAAA,CAAK,CAAC,CAAA,KAAM,wBAAA,CAAyB,GAAA,EAAK,CAAC,EAAE,GAAA,IAAO,CAAA,CAAE,GAAG,CAAC,CAAC,CAAA;AACzE,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,OAAO,IAAA,CAAK,cAAc,KAAK,CAAA;AAAA,IACjC;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAQ,OAAO,YAAA;AACrC,IAAA,MAAM,WACJ,OAAO,KAAA,KAAU,QAAA,GACb,KAAA,GACA,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,KAAA,KAAU,aAAa,OAAO,KAAA,KAAU,QAAA,GAC1E,MAAA,CAAO,KAAK,CAAA,GACZ,MAAA;AAER,IAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,MAAA,IAAI,QAAA,KAAa,QAAW,OAAO,YAAA;AACnC,MAAA,MAAM,IAAA,GAAO,KAAK,GAAA,CAAI,CAAA,EAAG,KAAK,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AAC9C,MAAA,OAAO,QAAA,CAAS,MAAA,IAAU,IAAA,GAAO,CAAA,EAAG,QAAQ,CAAA,MAAA,CAAA,GAAM,CAAA,EAAG,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,IAAI,CAAC,CAAA,MAAA,CAAA;AAAA,IAC9E;AAEA,IAAA,IAAI,IAAA,CAAK,aAAa,MAAA,EAAQ;AAC5B,MAAA,IAAI,QAAA,KAAa,QAAW,OAAO,gBAAA;AACnC,MAAA,OAAO,CAAA,MAAA,EAAS,UAAA,CAAW,QAAQ,CAAC,CAAA,CAAA,CAAA;AAAA,IACtC;AAEA,IAAA,OAAO,IAAA,CAAK,cAAc,KAAK,CAAA;AAAA,EACjC;AAAA,EAEA,aAAa,MAAA,EAA0D;AACrE,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC3C,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AAAA,IAChC;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEA,cAAc,KAAA,EAAyB;AACrC,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,MAAA,OAAO,MAAM,GAAA,CAAI,CAAC,MAAM,IAAA,CAAK,aAAA,CAAc,CAAC,CAAC,CAAA;AAAA,IAC/C;AACA,IAAA,IAAI,QAAA,CAAS,KAAK,CAAA,EAAG;AACnB,MAAA,MAAM,MAA+B,EAAC;AACtC,MAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1C,QAAA,GAAA,CAAI,CAAC,CAAA,GAAI,IAAA,CAAK,WAAA,CAAY,GAAG,CAAC,CAAA;AAAA,MAChC;AACA,MAAA,OAAO,GAAA;AAAA,IACT;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AACF","file":"chunk-VLVCLAPB.mjs","sourcesContent":["/**\n * Contextual sensitive-key classification for safety checks and redaction.\n *\n * Avoids treating model token-configuration fields (ls_max_tokens, max_tokens,\n * token_count, …) as credentials solely because they contain the substring\n * \"token\". Value-based secret detectors remain separate.\n *\n * @experimental Shared classifier used by checks (6.14.2+); parity across\n * surfaces lands in the same patch train.\n */\n\n/** True when the original key already uses an explicit separator. */\nfunction keyHasExplicitSeparator(value: string): boolean {\n  return /[_\\-.]/.test(value);\n}\n\n/**\n * Canonicalize field names so camelCase / kebab / dot / snake forms share a\n * snake_case shape the compound matcher can recognize (`userPassword` →\n * `user_password`).\n */\nexport function normalizeSensitiveKey(value: string): string {\n  return value\n    .replace(/([a-z0-9])([A-Z])/g, \"$1_$2\")\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n}\n\n/** Model / usage configuration keys that are not credentials by key alone. */\nexport const NON_CREDENTIAL_TOKEN_CONFIG_KEYS: ReadonlySet<string> = new Set(\n  [\n    \"tokens\",\n    \"max_tokens\",\n    \"min_tokens\",\n    \"ls_max_tokens\",\n    \"token_count\",\n    \"token_limit\",\n    \"token_budget\",\n    \"input_tokens\",\n    \"output_tokens\",\n    \"total_tokens\",\n    \"cached_tokens\",\n    \"prompt_tokens\",\n    \"completion_tokens\",\n  ].map(normalizeSensitiveKey),\n);\n\nexport const DEFAULT_CREDENTIAL_SENSITIVE_KEYS = [\n  \"authorization\",\n  \"cookie\",\n  \"token\",\n  \"access_token\",\n  \"accesstoken\",\n  \"auth_token\",\n  \"authtoken\",\n  \"refresh_token\",\n  \"refreshtoken\",\n  \"id_token\",\n  \"idtoken\",\n  \"bearer_token\",\n  \"bearertoken\",\n  \"api_token\",\n  \"apitoken\",\n  \"apikey\",\n  \"api_key\",\n  \"password\",\n  \"secret\",\n  \"email\",\n] as const;\n\nfunction isTokenCredentialKey(normalized: string): boolean {\n  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;\n  if (normalized === \"token\") return true;\n  // access_token / refreshToken → *token, but not *tokens (max_tokens → max_tokens)\n  if (normalized.endsWith(\"tokens\")) return false;\n  return normalized.endsWith(\"token\");\n}\n\n/**\n * True when the field name looks credential-sensitive under the shared policy.\n *\n * Suffix compounds (`user_password`, `userPassword`) always match. Prefix\n * compounds (`email_note`) match only when the original key already contained\n * an explicit separator, so camelCase topic fields like `emailNote` stay for\n * value detectors instead of key redaction.\n */\nexport function isCredentialSensitiveKey(\n  key: string | undefined,\n  sensitiveKeys: readonly string[] = DEFAULT_CREDENTIAL_SENSITIVE_KEYS,\n): boolean {\n  if (!key) return false;\n  const normalized = normalizeSensitiveKey(key);\n  if (!normalized) return false;\n  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;\n\n  const allowPrefixCompound = keyHasExplicitSeparator(key);\n\n  for (const sensitive of sensitiveKeys) {\n    const s = normalizeSensitiveKey(sensitive);\n    if (!s) continue;\n    if (s === \"token\") {\n      if (isTokenCredentialKey(normalized)) return true;\n      continue;\n    }\n    if (normalized === s) return true;\n    // Compound keys with explicit separators, plus camelCase owner+secret suffixes.\n    if (normalized.endsWith(`_${s}`)) return true;\n    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;\n  }\n  return false;\n}\n","import crypto from \"node:crypto\";\n\nimport { isCredentialSensitiveKey } from \"../safety/sensitive-key.js\";\n\nimport type { RedactionRule } from \"../types/log-config.js\";\n\nexport const DEFAULT_REDACT_KEYS = [\n  \"authorization\",\n  \"cookie\",\n  \"token\",\n  \"apiKey\",\n  \"password\",\n  \"secret\",\n  \"email\",\n] as const;\n\nexport interface RedactorOptions {\n  rules?: RedactionRule[];\n  /** Additional exact keys (case-insensitive) to redact in addition to defaults. */\n  extraKeys?: readonly string[];\n}\n\nfunction isRecord(v: unknown): v is Record<string, unknown> {\n  return typeof v === \"object\" && v !== null && !Array.isArray(v);\n}\n\nfunction toKey(s: string): string {\n  return s.toLowerCase();\n}\n\nfunction stableHash(value: string): string {\n  const h = crypto.createHash(\"sha256\").update(value, \"utf8\").digest(\"hex\");\n  return h.slice(0, 8);\n}\n\ntype CompiledRule = (\n  | { key: string; strategy: \"full\" }\n  | { key: string; strategy: \"prefix\"; keep: number }\n  | { key: string; strategy: \"hash\" }\n) & { raw?: string };\n\nfunction compileRules(\n  rules?: RedactionRule[],\n  extraKeys?: readonly string[],\n): CompiledRule[] {\n  const out = new Map<string, CompiledRule>();\n\n  const set = (r: CompiledRule) => {\n    const k = toKey(r.key);\n    out.set(k, { ...r, key: k, raw: r.raw ?? r.key } as CompiledRule);\n  };\n\n  for (const k of DEFAULT_REDACT_KEYS) {\n    set({ key: k, strategy: \"full\" });\n  }\n\n  for (const k of extraKeys ?? []) {\n    if (typeof k === \"string\" && k.length > 0) {\n      set({ key: k, strategy: \"full\" });\n    }\n  }\n\n  for (const r of rules ?? []) {\n    if (typeof r === \"string\") {\n      set({ key: r, strategy: \"full\" });\n      continue;\n    }\n    const key = r.key;\n    if (r.strategy === \"full\") set({ key, strategy: \"full\" });\n    if (r.strategy === \"hash\") set({ key, strategy: \"hash\" });\n    if (r.strategy === \"prefix\") {\n      set({ key, strategy: \"prefix\", keep: typeof r.keep === \"number\" ? r.keep : 8 });\n    }\n  }\n\n  return [...out.values()];\n}\n\nexport class Redactor {\n  readonly #rules: CompiledRule[];\n\n  constructor(options?: RedactorOptions) {\n    this.#rules = compileRules(options?.rules, options?.extraKeys);\n  }\n\n  /** Field names this redactor treats as sensitive, for value-level helpers. */\n  get sensitiveKeys(): readonly string[] {\n    return this.#rules.map((rule) => rule.raw ?? rule.key);\n  }\n\n  redactValue(key: string, value: unknown): unknown {\n    const k = toKey(key);\n    const rule =\n      this.#rules.find((r) => r.key === k) ??\n      this.#rules.find((r) => isCredentialSensitiveKey(key, [r.raw ?? r.key]));\n    if (!rule) {\n      return this.#redactNested(value);\n    }\n\n    if (rule.strategy === \"full\") return \"[REDACTED]\";\n    const asString =\n      typeof value === \"string\"\n        ? value\n        : typeof value === \"number\" || typeof value === \"boolean\" || typeof value === \"bigint\"\n          ? String(value)\n          : undefined;\n\n    if (rule.strategy === \"prefix\") {\n      if (asString === undefined) return \"[REDACTED]\";\n      const keep = Math.max(0, Math.floor(rule.keep));\n      return asString.length <= keep ? `${asString}…` : `${asString.slice(0, keep)}…`;\n    }\n\n    if (rule.strategy === \"hash\") {\n      if (asString === undefined) return \"[HASH:unknown]\";\n      return `[HASH:${stableHash(asString)}]`;\n    }\n\n    return this.#redactNested(value);\n  }\n\n  redactRecord(record: Record<string, unknown>): Record<string, unknown> {\n    const out: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(record)) {\n      out[k] = this.redactValue(k, v);\n    }\n    return out;\n  }\n\n  #redactNested(value: unknown): unknown {\n    if (Array.isArray(value)) {\n      return value.map((v) => this.#redactNested(v));\n    }\n    if (isRecord(value)) {\n      const out: Record<string, unknown> = {};\n      for (const [k, v] of Object.entries(value)) {\n        out[k] = this.redactValue(k, v);\n      }\n      return out;\n    }\n    return value;\n  }\n}\n\n"]}