OptionaldiagnosticsDiagnostic-only selectors, IN ADDITION to the state selectors above (which
already cover a diagnostic entry by its name: keys: ['token'] masks
$debug('token', …)). Use these for names you mask in diagnostics but
not in state. Paths start with logs/errors/metrics/evals, e.g.
logs.profile.token. Only flowMessages.description and
flowMessages.rationale are payloads; flow topology/timing metadata stays
intact. Applied before retention, not retroactively to existing bags.
OptionalemitRegex patterns matched against EmitEvent.name for scope.$emit(...)
calls. Any emit event whose name matches has its payload replaced with
the string '[REDACTED]' before dispatch to recorders.
Global/sticky patterns start at index zero on every test; their flags
retain their usual meaning. This does not scrub diagnostic side bags.
Example:
{ emitPatterns: [/\.auth\./, /\.billing\./] }
// Hides payloads of events like 'myapp.auth.check' and 'myapp.billing.spend'
OptionalfieldsField-level redaction within objects — key → array of fields to scrub. Supports dot-notation for nested paths (e.g. 'address.zip').
OptionalkeysExact key names to always redact (e.g. ['ssn', 'creditCard']).
OptionalpatternsRegex patterns — any key matching a pattern is auto-redacted.
Pattern matching is skipped for keys that exceed an internal length cap
(designed to prevent ReDoS on pathological patterns). For very long key
names, use keys (exact match) instead of patterns.
A pattern that depends on a dotted PATH (for example /auth\.token/) is
tested against paths inside a value handed out whole. A path past the same
cap cannot be tested, so the value at it is served as the placeholder: the
safe side. Use keys or fields for values that deep.
Declarative key/path redaction for recorded state and boundary records.
Configure at the scope class level (static property) or pass to FlowChartExecutor to apply across all stages.