@a2a-exposed/control-core 0.8.32 → 0.8.34

package/dist/index.js

@@ -3192,8 +3192,12 @@ var BASIC_RE = /(basic\s+)(\S+)/gi;
 var PEM_RE = /-----BEGIN (?:[A-Z0-9]+ )?PRIVATE KEY-----[\s\S]*?(?:-----END (?:[A-Z0-9]+ )?PRIVATE KEY-----|$)/g;
 var API_KEY_RE = /(?:(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|\bAKIA[0-9A-Z]{16}\b|\bsk_(?:live|test)_[A-Za-z0-9]{10,}|\brk_(?:live|test)_[A-Za-z0-9]{10,}|\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}|\bxox[baprs]-[A-Za-z0-9-]{10,}|\bAIza[0-9A-Za-z_-]{35}\b)/g;
 var JWT_RE = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g;
-var AUTH_RE = /\b((?:proxy-)?authorization)(\s*[:=]\s*)([^\n]+)/gi;
+var AUTH_RE = /\b((?:proxy-)?authorization)(\s*[:=]\s*)([^\r\n]+)/gi;
 var QUERY_RE = /(^|[?&#\s])([^?&#\s="'<>]+)(\s*=\s*)("(?:\\.|[^"\\])*(?:"|$)|'(?:\\.|[^'\\])*(?:'|$)|(?:\\(?!["'])|[^&#\s"'<>\\])*)/g;
+var HEADER_RE = /\b([A-Za-z][A-Za-z0-9_-]*)([ \t]*:[ \t]*)/g;
+var CONFIG_LINE_RE = /^([ \t]*)([A-Z_][A-Z0-9_]*)([ \t]*=[ \t]*)([^\r\n]*)/gm;
+var URL_PATH_RE = /(\bhttps?:\/\/[^/?#\s"'<>]+)([^?#\s"'<>]*)/gi;
+var QUERY_SECRET = /* @__PURE__ */ new Set(["key", "sig", "code", "codeverifier"]);
 var ASSIGN_RE = /\b([A-Za-z_][A-Za-z0-9_]*)(\s*=\s*)/g;
 var SECRET_EXACT = /* @__PURE__ */ new Set([
   "authorization",
@@ -3203,6 +3207,8 @@ var SECRET_EXACT = /* @__PURE__ */ new Set([
   "password",
   "passwd",
   "secret",
+  "secrets",
+  "signature",
   "token",
   "apikey",
   "accesstoken",
@@ -3216,9 +3222,12 @@ var SECRET_EXACT = /* @__PURE__ */ new Set([
   "bearer",
   "webhookkey",
   "accessclientid",
-  "accessclientsecret"
+  "accessclientsecret",
+  "xhubsignature256"
 ]);
 var SECRET_SUFFIX = [
+  "secrets",
+  "signature",
   "authorization",
   "token",
   "secret",
@@ -3273,6 +3282,38 @@ function unquotedValueEnd(text, start) {
   while (i < text.length && !/\s/.test(text[i])) i += 1;
   return i;
 }
+function jsonStringSpans(text) {
+  const strings = [];
+  for (let i = 0; i < text.length; i += 1) {
+    if (text[i] !== '"') continue;
+    const end = quotedValueEnd(text, i);
+    try {
+      JSON.parse(text.slice(i, end));
+      strings.push([i, end]);
+    } catch {
+    }
+    i = end - 1;
+  }
+  return strings;
+}
+function redactHeaderLines(text) {
+  const strings = jsonStringSpans(text);
+  const pattern = new RegExp(HEADER_RE.source, "g");
+  let out = "";
+  let last = 0;
+  let match;
+  while ((match = pattern.exec(text)) !== null) {
+    if (!secretName(match[1]) || strings.some(([start2, end2]) => match.index >= start2 && match.index < end2)) continue;
+    const start = pattern.lastIndex;
+    let end = start;
+    while (end < text.length && !/[\r\n]/.test(text[end])) end += 1;
+    if (end === start) continue;
+    out += text.slice(last, start) + REDACTED;
+    last = end;
+    pattern.lastIndex = end;
+  }
+  return out + text.slice(last);
+}
 function redactAssignments(text) {
   const pattern = new RegExp(ASSIGN_RE.source, "g");
   const parameters = Array.from(text.matchAll(new RegExp(QUERY_RE.source, "g")));
@@ -3377,19 +3418,43 @@ function redactNested(value, depth, cache = /* @__PURE__ */ new Map()) {
     return REDACTED;
   }
 }
+function redactEnvironmentLines(text) {
+  const pattern = new RegExp(CONFIG_LINE_RE.source, "gm");
+  let out = "";
+  let last = 0;
+  let match;
+  while ((match = pattern.exec(text)) !== null) {
+    const [, indent, name, sep, item] = match;
+    const structured = item.startsWith("{") || item.startsWith("[");
+    const parameterList = /^[^\s<>]*[&#][^?&#\s="'<>]+[ \t]*=/.test(item) && !structured;
+    if (!secretName(name) || !item || /^["']/.test(item) || parameterList || /\b[A-Za-z_][A-Za-z0-9_]*\s*=\s*$/.test(item)) continue;
+    const start = match.index + indent.length + name.length + sep.length;
+    const end = structured ? jsonValueEnd(text, start) : pattern.lastIndex;
+    out += text.slice(last, start) + REDACTED;
+    last = end;
+    pattern.lastIndex = end;
+  }
+  return out + text.slice(last);
+}
 function redactText(value, depth, cache) {
   let text = redactJsonFields(value, depth, cache);
   text = replaceAll(text, PEM_RE, REDACTED);
+  text = redactEnvironmentLines(text);
   text = replaceAll(text, JWT_RE, REDACTED);
   text = replaceAll(text, API_KEY_RE, REDACTED);
   text = replaceAll(text, TOKEN_RE, REDACTED);
   text = replaceAll(text, BEARER_RE, `$1${REDACTED}`);
   text = replaceAll(text, BASIC_RE, `$1${REDACTED}`);
-  text = replaceAll(text, AUTH_RE, (_all, name, sep, rest) => {
+  text = redactHeaderLines(text);
+  const authStrings = jsonStringSpans(text);
+  text = text.replace(AUTH_RE, (all, name, sep, rest, offset) => {
+    if (authStrings.some(([start, end]) => offset >= start && offset < end)) return all;
     if (rest.trim().length < 8 && !/bearer|basic/i.test(rest)) return `${name}${sep}${rest}`;
     return `${name}${sep}${REDACTED}`;
   });
   text = replaceAll(text, USERINFO_RE, `$1${REDACTED}@`);
+  text = text.replace(/(\/webhooks\/)\d+\/[^/?#\s"'<>]+/gi, `$1${REDACTED}/${REDACTED}`).replace(/(\/(?:hooks|webhooks)\/)[^/?#\s"'<>]+/gi, `$1${REDACTED}`).replace(/\/bot[0-9]+:[^/?#\s"'<>]+/gi, `/bot${REDACTED}`);
+  text = replaceAll(text, URL_PATH_RE, (_all, origin, path) => origin + path.replace(/\/[^/]{16,}/g, `/${REDACTED}`));
   const cleanParameter = (all, sep, name, assignment, item) => {
     let decoded = name;
     while (true) {
@@ -3408,7 +3473,7 @@ function redactText(value, depth, cache) {
       setup = /^[A-Za-z0-9_-]{16,}/.test(candidate);
     }
     if (!item) return all;
-    if (!secretName(decoded) && !setup) {
+    if (!secretName(decoded) && !QUERY_SECRET.has(compactName(decoded)) && !setup) {
       const quote = item[0];
       const wrapped = (quote === '"' || quote === "'") && item.endsWith(quote) && item.length > 1;
       const cleaned = wrapped ? quote + redactNested(item.slice(1, -1), depth + 1, cache) + quote : redactNested(item, depth + 1, cache);
@@ -3416,17 +3481,7 @@ function redactText(value, depth, cache) {
     }
     return `${sep}${name}${assignment}${REDACTED}`;
   };
-  const strings = [];
-  for (let i = 0; i < text.length; i += 1) {
-    if (text[i] !== '"') continue;
-    const end = quotedValueEnd(text, i);
-    try {
-      JSON.parse(text.slice(i, end));
-      strings.push([i, end]);
-    } catch {
-    }
-    i = end - 1;
-  }
+  const strings = jsonStringSpans(text);
   const parameters = new RegExp(QUERY_RE.source, "g");
   let out = "";
   let last = 0;
@@ -3478,6 +3533,17 @@ function walk(value, seen) {
     return value.map((item) => walk(item, seen));
   }
   const proto = Object.getPrototypeOf(value);
+  if (value instanceof Error) {
+    const out2 = new Error();
+    Object.setPrototypeOf(out2, proto);
+    delete out2.stack;
+    for (const key of Reflect.ownKeys(value)) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      const item = "value" in descriptor && !(typeof key === "string" && secretName(key)) ? walk(descriptor.value, seen) : REDACTED;
+      Object.defineProperty(out2, key, { value: item, enumerable: descriptor.enumerable, configurable: true, writable: true });
+    }
+    return out2;
+  }
   if (proto !== Object.prototype && proto !== null) return value;
   const record = value;
   const hidden = /* @__PURE__ */ new Set();

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@a2a-exposed/control-core",
-	"version": "0.8.32",
+	"version": "0.8.34",
 	"description": "A2A endpoint provisioning, routing, and D1 migrations for a2a-exposed.",
 	"type": "module",
 	"scripts": {