@bgord/bun 1.23.9 → 1.23.11

package/dist/markdown-generator.adapter.d.ts

@@ -1,5 +1,6 @@
 import type { MarkdownGeneratorPort } from "./markdown-generator.port";
 export declare class MarkdownGeneratorAdapter implements MarkdownGeneratorPort {
+    private static readonly ALLOWED_SCHEMES;
     generate(template: string): string;
 }
 //# sourceMappingURL=markdown-generator.adapter.d.ts.map

package/dist/markdown-generator.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markdown-generator.adapter.d.ts","sourceRoot":"","sources":["../src/markdown-generator.adapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,qBAAa,wBAAyB,YAAW,qBAAqB;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjC;CACF"}
+{"version":3,"file":"markdown-generator.adapter.d.ts","sourceRoot":"","sources":["../src/markdown-generator.adapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,qBAAa,wBAAyB,YAAW,qBAAqB;IACpE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAA+B;IAEtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CASjC;CACF"}

package/dist/markdown-generator.adapter.js

@@ -1,6 +1,13 @@
 export class MarkdownGeneratorAdapter {
+    static ALLOWED_SCHEMES = ["http", "https", "mailto"];
     generate(template) {
-        return Bun.markdown.html(template, { tagFilter: true, noHtmlBlocks: true, noHtmlSpans: true });
+        const html = Bun.markdown.html(template, { tagFilter: true, noHtmlBlocks: true, noHtmlSpans: true });
+        return html.replace(/ href="([^"]*)"/g, (attribute, url) => {
+            const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(url)?.[1]?.toLowerCase();
+            if (scheme === undefined || MarkdownGeneratorAdapter.ALLOWED_SCHEMES.includes(scheme))
+                return attribute;
+            return ' href="#"';
+        });
     }
 }
 //# sourceMappingURL=markdown-generator.adapter.js.map

package/dist/markdown-generator.adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"markdown-generator.adapter.js","sourceRoot":"","sources":["../src/markdown-generator.adapter.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,wBAAwB;IACnC,QAAQ,CAAC,QAAgB;QACvB,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;CACF"}
+{"version":3,"file":"markdown-generator.adapter.js","sourceRoot":"","sources":["../src/markdown-generator.adapter.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,wBAAwB;IAC3B,MAAM,CAAU,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEtE,QAAQ,CAAC,QAAgB;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAErG,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,SAAS,EAAE,GAAW,EAAE,EAAE;YACjE,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YAEtE,IAAI,MAAM,KAAK,SAAS,IAAI,wBAAwB,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxG,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/redactor-key.vo.d.ts

@@ -0,0 +1,8 @@
+export declare class RedactorKey {
+    private readonly value;
+    private constructor();
+    static fromString(candidate: string): RedactorKey;
+    get(): string;
+    matches(another: RedactorKey): boolean;
+}
+//# sourceMappingURL=redactor-key.vo.d.ts.map

package/dist/redactor-key.vo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactor-key.vo.d.ts","sourceRoot":"","sources":["../src/redactor-key.vo.ts"],"names":[],"mappings":"AAAA,qBAAa,WAAW;IACF,OAAO,CAAC,QAAQ,CAAC,KAAK;IAA1C,OAAO,eAA+C;IAEtD,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,CAEhD;IAED,GAAG,IAAI,MAAM,CAEZ;IAED,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAErC;CACF"}

package/dist/redactor-key.vo.js

@@ -0,0 +1,16 @@
+export class RedactorKey {
+    value;
+    constructor(value) {
+        this.value = value;
+    }
+    static fromString(candidate) {
+        return new RedactorKey(candidate.toLowerCase().replace(/[_-]/g, ""));
+    }
+    get() {
+        return this.value;
+    }
+    matches(another) {
+        return this.value === another.value;
+    }
+}
+//# sourceMappingURL=redactor-key.vo.js.map

package/dist/redactor-key.vo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactor-key.vo.js","sourceRoot":"","sources":["../src/redactor-key.vo.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,WAAW;IACe,KAAK;IAA1C,YAAqC,KAAa;qBAAb,KAAK;IAAW,CAAC;IAEtD,MAAM,CAAC,UAAU,CAAC,SAAiB;QACjC,OAAO,IAAI,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,GAAG;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,OAAO,CAAC,OAAoB;QAC1B,OAAO,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC;IACtC,CAAC;CACF"}

package/dist/redactor-mask.strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redactor-mask.strategy.d.ts","sourceRoot":"","sources":["../src/redactor-mask.strategy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,qBAAa,YAAa,YAAW,gBAAgB;IACnD,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAiBjD;IAEF,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;IAEnC,YAAY,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,EAEvC;IAED,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAIrB;CACF"}
+{"version":3,"file":"redactor-mask.strategy.d.ts","sourceRoot":"","sources":["../src/redactor-mask.strategy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,qBAAa,YAAa,YAAW,gBAAgB;IACnD,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAqBjD;IAEF,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;IAEnC,YAAY,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,EAIvC;IAED,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAIrB;CACF"}

package/dist/redactor-mask.strategy.js

@@ -1,30 +1,35 @@
 /* cspell:disable */
 import * as tools from "@bgord/tools";
+import { RedactorKey } from "./redactor-key.vo";
 export class RedactorMask {
     static DEFAULT_KEYS = [
         "authorization",
+        "proxy-authorization",
         "cookie",
         "set-cookie",
         "x-api-key",
+        "x-auth-token",
         "apikey",
         "token",
         "accesstoken",
         "refreshtoken",
+        "idtoken",
         "password",
         "currentpassword",
         "newpassword",
         "passwordconfirmation",
         "clientsecret",
+        "privatekey",
         "secret",
         "otp",
         "code",
     ];
     keys;
     constructor(keys) {
-        this.keys = new Set((keys?.length ? keys : RedactorMask.DEFAULT_KEYS).map((key) => key.toLowerCase()));
+        this.keys = new Set((keys?.length ? keys : RedactorMask.DEFAULT_KEYS).map((key) => RedactorKey.fromString(key).get()));
     }
     redact(input) {
-        return tools.deepCloneWith(input, (_value, key) => typeof key === "string" && this.keys.has(key.toLowerCase()) ? "***" : undefined);
+        return tools.deepCloneWith(input, (_value, key) => typeof key === "string" && this.keys.has(RedactorKey.fromString(key).get()) ? "***" : undefined);
     }
 }
 //# sourceMappingURL=redactor-mask.strategy.js.map

package/dist/redactor-mask.strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"redactor-mask.strategy.js","sourceRoot":"","sources":["../src/redactor-mask.strategy.ts"],"names":[],"mappings":"AAAA,oBAAoB;AACpB,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,MAAM,OAAO,YAAY;IACvB,MAAM,CAAU,YAAY,GAA0B;QACpD,eAAe;QACf,QAAQ;QACR,YAAY;QACZ,WAAW;QACX,QAAQ;QACR,OAAO;QACP,aAAa;QACb,cAAc;QACd,UAAU;QACV,iBAAiB;QACjB,aAAa;QACb,sBAAsB;QACtB,cAAc;QACd,QAAQ;QACR,KAAK;QACL,MAAM;KACP,CAAC;IAEe,IAAI,CAAc;IAEnC,YAAY,IAA4B;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,CAAI,KAAQ;QAChB,OAAO,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAChD,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAChF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"redactor-mask.strategy.js","sourceRoot":"","sources":["../src/redactor-mask.strategy.ts"],"names":[],"mappings":"AAAA,oBAAoB;AACpB,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,OAAO,YAAY;IACvB,MAAM,CAAU,YAAY,GAA0B;QACpD,eAAe;QACf,qBAAqB;QACrB,QAAQ;QACR,YAAY;QACZ,WAAW;QACX,cAAc;QACd,QAAQ;QACR,OAAO;QACP,aAAa;QACb,cAAc;QACd,SAAS;QACT,UAAU;QACV,iBAAiB;QACjB,aAAa;QACb,sBAAsB;QACtB,cAAc;QACd,YAAY;QACZ,QAAQ;QACR,KAAK;QACL,MAAM;KACP,CAAC;IAEe,IAAI,CAAc;IAEnC,YAAY,IAA4B;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CACjB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,CAAI,KAAQ;QAChB,OAAO,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAChD,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAChG,CAAC;IACJ,CAAC;CACF"}

package/dist/redactor-url-query.strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redactor-url-query.strategy.d.ts","sourceRoot":"","sources":["../src/redactor-url-query.strategy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,qBAAa,gBAAiB,YAAW,gBAAgB;IACvD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;IAEnC,YAAY,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,EAEvC;IAED,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAKrB;IAED,OAAO,CAAC,IAAI;CAcb"}
+{"version":3,"file":"redactor-url-query.strategy.d.ts","sourceRoot":"","sources":["../src/redactor-url-query.strategy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAI5D,qBAAa,gBAAiB,YAAW,gBAAgB;IACvD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;IAEnC,YAAY,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,EAIvC;IAED,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAKrB;IAED,OAAO,CAAC,IAAI;CAcb"}

package/dist/redactor-url-query.strategy.js

@@ -1,9 +1,10 @@
 import * as tools from "@bgord/tools";
+import { RedactorKey } from "./redactor-key.vo";
 import { RedactorMask } from "./redactor-mask.strategy";
 export class RedactorUrlQuery {
     keys;
     constructor(keys) {
-        this.keys = new Set((keys?.length ? keys : RedactorMask.DEFAULT_KEYS).map((key) => key.toLowerCase()));
+        this.keys = new Set((keys?.length ? keys : RedactorMask.DEFAULT_KEYS).map((key) => RedactorKey.fromString(key).get()));
     }
     redact(input) {
         if (!tools.isPlainObject(input))
@@ -18,7 +19,7 @@ export class RedactorUrlQuery {
             return url;
         const masked = new URLSearchParams(Array.from(new URLSearchParams(query), ([key, value]) => [
             key,
-            this.keys.has(key.toLowerCase()) ? "***" : value,
+            this.keys.has(RedactorKey.fromString(key).get()) ? "***" : value,
         ]));
         return `${base}?${masked.toString()}`;
     }

package/dist/redactor-url-query.strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"redactor-url-query.strategy.js","sourceRoot":"","sources":["../src/redactor-url-query.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,MAAM,OAAO,gBAAgB;IACV,IAAI,CAAc;IAEnC,YAAY,IAA4B;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,CAAI,KAAQ;QAChB,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEnD,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC;IAEO,IAAI,CAAC,GAAW;QACtB,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,CAAC,KAAK;YAAE,OAAO,GAAG,CAAC;QAEvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAChC,KAAK,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YACvD,GAAG;YACH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;SACjD,CAAC,CACH,CAAC;QAEF,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACxC,CAAC;CACF"}
+{"version":3,"file":"redactor-url-query.strategy.js","sourceRoot":"","sources":["../src/redactor-url-query.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,MAAM,OAAO,gBAAgB;IACV,IAAI,CAAc;IAEnC,YAAY,IAA4B;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CACjB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,CAAI,KAAQ;QAChB,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEnD,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC;IAEO,IAAI,CAAC,GAAW;QACtB,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,CAAC,KAAK;YAAE,OAAO,GAAG,CAAC;QAEvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAChC,KAAK,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YACvD,GAAG;YACH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;SACjE,CAAC,CACH,CAAC;QAEF,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACxC,CAAC;CACF"}

package/dist/shield-body-limit.strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shield-body-limit.strategy.d.ts","sourceRoot":"","sources":["../src/shield-body-limit.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,MAAM,MAAM,qBAAqB,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAA;CAAE,CAAC;AAE5D,eAAO,MAAM,oBAAoB;IAAK,MAAM;CAAgC,CAAC;AAE7E,qBAAa,uBAAuB;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,qBAAqB,EAAI;IAE9D,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAa3C;CACF"}
+{"version":3,"file":"shield-body-limit.strategy.d.ts","sourceRoot":"","sources":["../src/shield-body-limit.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,MAAM,MAAM,qBAAqB,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAA;CAAE,CAAC;AAE5D,eAAO,MAAM,oBAAoB;IAAK,MAAM;CAAgC,CAAC;AAE7E,qBAAa,uBAAuB;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,qBAAqB,EAAI;IAE9D,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAc3C;CACF"}

package/dist/shield-body-limit.strategy.js

@@ -8,6 +8,7 @@ export class ShieldBodyLimitStrategy {
     }
     evaluate(context) {
         const header = context.request.header("content-length");
+        // Header-only check: bodies without Content-Length (chunked/streamed) are bounded by Bun.serve's maxRequestBodySize instead.
         if (header === undefined)
             return true;
         const contentLength = v.safeParse(tools.SizeBytes, Number(header));

package/dist/shield-body-limit.strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"shield-body-limit.strategy.js","sourceRoot":"","sources":["../src/shield-body-limit.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAK7B,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;AAE7E,MAAM,OAAO,uBAAuB;IACL,MAAM;IAAnC,YAA6B,MAA6B;sBAA7B,MAAM;IAA0B,CAAC;IAE9D,QAAQ,CAAC,OAAyB;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAExD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAEtC,MAAM,aAAa,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAEnE,IAAI,CAAC,aAAa,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAEzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAExD,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"shield-body-limit.strategy.js","sourceRoot":"","sources":["../src/shield-body-limit.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAK7B,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;AAE7E,MAAM,OAAO,uBAAuB;IACL,MAAM;IAAnC,YAA6B,MAA6B;sBAA7B,MAAM;IAA0B,CAAC;IAE9D,QAAQ,CAAC,OAAyB;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAExD,6HAA6H;QAC7H,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAEtC,MAAM,aAAa,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAEnE,IAAI,CAAC,aAAa,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAEzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAExD,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/trailing-slash.middleware.d.ts

@@ -1,4 +1,4 @@
-import type { HasRequestPath } from "./request-context.port";
+import type { HasRequestUrl } from "./request-context.port";
 export type TrailingSlashResult = {
     redirect: false;
 } | {
@@ -8,6 +8,6 @@ export type TrailingSlashResult = {
 };
 export declare class TrailingSlashMiddleware {
     static readonly STATUS = 308;
-    evaluate(context: HasRequestPath): TrailingSlashResult;
+    evaluate(context: HasRequestUrl): TrailingSlashResult;
 }
 //# sourceMappingURL=trailing-slash.middleware.d.ts.map

package/dist/trailing-slash.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trailing-slash.middleware.d.ts","sourceRoot":"","sources":["../src/trailing-slash.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,MAAM,MAAM,mBAAmB,GAAG;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAK1G,qBAAa,uBAAuB;IAElC,MAAM,CAAC,QAAQ,CAAC,MAAM,OAAO;IAE7B,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,mBAAmB,CAUrD;CACF"}
+{"version":3,"file":"trailing-slash.middleware.d.ts","sourceRoot":"","sources":["../src/trailing-slash.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE5D,MAAM,MAAM,mBAAmB,GAAG;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAI1G,qBAAa,uBAAuB;IAElC,MAAM,CAAC,QAAQ,CAAC,MAAM,OAAO;IAE7B,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,mBAAmB,CASpD;CACF"}

package/dist/trailing-slash.middleware.js

@@ -1,14 +1,14 @@
-const TRAILING_SLASHES = /\/+$/;
-const LEADING_SLASHES = /^\/+/;
+const EDGE_SLASHES = /^\/+|\/+$/g;
 export class TrailingSlashMiddleware {
     // RFC 7231 6.4.7 - 308 preserves the request method and body, unlike 301.
     static STATUS = 308;
     evaluate(context) {
-        if (!context.request.path.endsWith("/"))
+        const path = new URL(context.request.url()).pathname;
+        if (!path.endsWith("/"))
             return { redirect: false };
-        if (context.request.path === "/")
+        if (path === "/")
             return { redirect: false };
-        const pathname = (context.request.path.replace(TRAILING_SLASHES, "") || "/").replace(LEADING_SLASHES, "/");
+        const pathname = `/${path.replace(EDGE_SLASHES, "")}`;
         return { redirect: true, pathname, status: TrailingSlashMiddleware.STATUS };
     }
 }

package/dist/trailing-slash.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"trailing-slash.middleware.js","sourceRoot":"","sources":["../src/trailing-slash.middleware.ts"],"names":[],"mappings":"AAIA,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,OAAO,uBAAuB;IAClC,0EAA0E;IAC1E,MAAM,CAAU,MAAM,GAAG,GAAG,CAAC;IAE7B,QAAQ,CAAC,OAAuB;QAC9B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACpE,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,GAAG;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAE7D,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAClF,eAAe,EACf,GAAG,CACJ,CAAC;QAEF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,CAAC,MAAM,EAAE,CAAC;IAC9E,CAAC;CACF"}
+{"version":3,"file":"trailing-slash.middleware.js","sourceRoot":"","sources":["../src/trailing-slash.middleware.ts"],"names":[],"mappings":"AAIA,MAAM,YAAY,GAAG,YAAY,CAAC;AAElC,MAAM,OAAO,uBAAuB;IAClC,0EAA0E;IAC1E,MAAM,CAAU,MAAM,GAAG,GAAG,CAAC;IAE7B,QAAQ,CAAC,OAAsB;QAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC;QAErD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACpD,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAE7C,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;QAEtD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,CAAC,MAAM,EAAE,CAAC;IAC9E,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bgord/bun",
-  "version": "1.23.9",
+  "version": "1.23.11",
   "type": "module",
   "license": "MIT",
   "author": "Bartosz Gordon",
@@ -26,9 +26,9 @@
     "@stryker-mutator/typescript-checker": "10.0.0",
     "@types/bun": "1.4.2",
     "@types/nodemailer": "8.0.2",
-    "better-auth": "1.7.5",
+    "better-auth": "1.7.6",
     "cspell": "10.3.3",
-    "fallow": "3.28.0",
+    "fallow": "3.30.0",
     "lefthook": "2.1.14",
     "lockfile-lint": "5.0.1",
     "nodemailer": "10.0.10",
@@ -38,12 +38,12 @@
   },
   "dependencies": {
     "@bgord/tools": "1.6.14",
-    "emittery": "2.0.0",
+    "emittery": "2.1.0",
     "hono": "4.13.8",
     "node-cache": "5.1.2"
   },
   "peerDependencies": {
-    "better-auth": "1.7.5",
+    "better-auth": "1.7.6",
     "nodemailer": "10.0.10"
   },
   "peerDependenciesMeta": {

package/readme.md

@@ -121,6 +121,7 @@ src/
 ├── crypto-key-provider-noop.adapter.ts
 ├── crypto-key-provider-with-memo.adapter.ts
 ├── crypto-key-provider.port.ts
+├── csv-formula-sanitizer.service.ts
 ├── csv-parser-noop.adapter.ts
 ├── csv-parser.port.ts
 ├── csv-stringifier-noop.adapter.ts
@@ -145,6 +146,7 @@ src/
 ├── environment-loader-noop.adapter.ts
 ├── environment-loader-process-safe.adapter.ts
 ├── environment-loader-process.adapter.ts
+├── environment-loader-with-memo.adapter.ts
 ├── environment-loader.port.ts
 ├── error-classifier-http-exception-hono.strategy.ts
 ├── error-classifier-invariant.strategy.ts
@@ -238,6 +240,9 @@ src/
 ├── handler-with-logger.strategy.ts
 ├── handler.strategy.ts
 ├── hash-bucket.vo.ts
+├── hash-bytes-noop.strategy.ts
+├── hash-bytes-sha256.strategy.ts
+├── hash-bytes.strategy.ts
 ├── hash-content-noop.strategy.ts
 ├── hash-content-sha256.strategy.ts
 ├── hash-content.strategy.ts
@@ -495,6 +500,7 @@ src/
 ├── redactor-composite.strategy.ts
 ├── redactor-error-cause-depth-limit.strategy.ts
 ├── redactor-error-stack-hide.strategy.ts
+├── redactor-key.vo.ts
 ├── redactor-mask.strategy.ts
 ├── redactor-metadata-compact-array.strategy.ts
 ├── redactor-metadata-compact-object.strategy.ts

package/src/cron-scheduler.adapter.ts

@@ -6,7 +6,8 @@ export class CronSchedulerAdapter implements CronSchedulerPort {
   private readonly tasks: Array<Bun.CronJob> = [];
 
   schedule(task: CronTask): void {
-    this.tasks.push(Bun.cron(task.cron, task.handler));
+    // Bun.cron turns a rejected run into an unhandledRejection, which GracefulShutdown treats as fatal.
+    this.tasks.push(Bun.cron(task.cron, () => task.handler().catch(() => {})));
   }
 
   async verify(): Promise<boolean> {

package/src/cron-task-handler-bare.strategy.ts

@@ -11,11 +11,13 @@ export class CronTaskHandlerBareStrategy implements CronTaskHandlerStrategy {
   constructor(private readonly deps: Dependencies) {}
 
   handle(task: CronTask): CronTask {
-    const correlationId = v.parse(CorrelationId, this.deps.IdProvider.generate());
-
     return {
       ...task,
-      handler: async () => CorrelationStorage.run(correlationId, task.handler),
+      handler: async () => {
+        const correlationId = v.parse(CorrelationId, this.deps.IdProvider.generate());
+
+        return CorrelationStorage.run(correlationId, task.handler);
+      },
     };
   }
 }

package/src/csv-formula-sanitizer.service.ts

@@ -0,0 +1,9 @@
+export class CsvFormulaSanitizer {
+  static readonly TRIGGERS = ["=", "+", "-", "@", "\t", "\r"];
+
+  static sanitize(value: string): string {
+    const triggered = CsvFormulaSanitizer.TRIGGERS.some((trigger) => value.startsWith(trigger));
+
+    return triggered ? `'${value}` : value;
+  }
+}

package/src/environment-loader-process-safe.adapter.ts

@@ -1,38 +1,18 @@
-import { CacheCodecIdentityStrategy } from "./cache-codec-identity.strategy";
-import type { CacheResolverStrategy } from "./cache-resolver.strategy";
-import type { CacheValueType } from "./cache-value.vo";
 import type {
   EnvironmentLoaderConfig,
   EnvironmentLoaderPort,
   EnvironmentResultType,
 } from "./environment-loader.port";
-import type { HashContentStrategy } from "./hash-content.strategy";
 import { StandardSchemaValidator } from "./standard-schema-validator.service";
-import { SubjectApplicationResolver } from "./subject-application-resolver.vo";
-import { SubjectSegmentFixedStrategy } from "./subject-segment-fixed.strategy";
-
-type Dependencies = { CacheResolver: CacheResolverStrategy; HashContent: HashContentStrategy };
-
-export class EnvironmentLoaderProcessSafeAdapter<T extends object & CacheValueType>
-  implements EnvironmentLoaderPort<T>
-{
-  private readonly codec = new CacheCodecIdentityStrategy<T>();
 
+export class EnvironmentLoaderProcessSafeAdapter<T extends object> implements EnvironmentLoaderPort<T> {
   constructor(
     private env: NodeJS.ProcessEnv,
     private readonly config: EnvironmentLoaderConfig<T>,
-    private readonly deps: Dependencies,
   ) {}
 
   async load(): Promise<Readonly<EnvironmentResultType<T>>> {
-    const resolver = new SubjectApplicationResolver([new SubjectSegmentFixedStrategy("env")], this.deps);
-    const subject = await resolver.resolve();
-
-    const parsed = await this.deps.CacheResolver.resolve<T>(
-      subject.hex,
-      async () => StandardSchemaValidator.validate(this.config.EnvironmentSchema, this.env),
-      this.codec,
-    );
+    const parsed = StandardSchemaValidator.validate(this.config.EnvironmentSchema, this.env);
 
     for (const key of Object.keys(parsed)) {
       delete this.env[key];

package/src/environment-loader-with-memo.adapter.ts

@@ -0,0 +1,21 @@
+import type { EnvironmentLoaderPort, EnvironmentResultType } from "./environment-loader.port";
+
+type Config<T extends object> = { inner: EnvironmentLoaderPort<T> };
+
+export class EnvironmentLoaderWithMemoAdapter<T extends object> implements EnvironmentLoaderPort<T> {
+  private memoized: Promise<Readonly<EnvironmentResultType<T>>> | null = null;
+
+  constructor(private readonly config: Config<T>) {}
+
+  async load(): Promise<Readonly<EnvironmentResultType<T>>> {
+    if (this.memoized === null) {
+      this.memoized = this.config.inner.load().catch((error) => {
+        this.memoized = null;
+
+        throw error;
+      });
+    }
+
+    return this.memoized;
+  }
+}

package/src/event-store-dispatching.adapter.ts

@@ -32,7 +32,8 @@ export class EventStoreDispatchingAdapter<Event extends GenericEvent> implements
   ): Promise<ReadonlyArray<SavedEvent>> {
     const saved = await this.deps.inner.save(events);
 
-    for (const event of saved) this.deps.EventBus.emit(event);
+    // Fire-and-forget: events are already persisted, handler errors are logged by the handler strategy.
+    for (const event of saved) this.deps.EventBus.emit(event).catch(() => {});
 
     return saved;
   }

package/src/hash-bytes-noop.strategy.ts

@@ -0,0 +1,8 @@
+import { Hash } from "./hash.vo";
+import type { HashBytesStrategy } from "./hash-bytes.strategy";
+
+export class HashBytesNoopStrategy implements HashBytesStrategy {
+  async hash(_content: ArrayBuffer): Promise<Hash> {
+    return Hash.fromString("0".repeat(64));
+  }
+}

package/src/hash-bytes-sha256.strategy.ts

@@ -0,0 +1,10 @@
+import { Hash } from "./hash.vo";
+import type { HashBytesStrategy } from "./hash-bytes.strategy";
+
+export class HashBytesSha256Strategy implements HashBytesStrategy {
+  async hash(content: ArrayBuffer): Promise<Hash> {
+    const digest = await crypto.subtle.digest("SHA-256", content);
+
+    return Hash.fromBuffer(new Uint8Array(digest));
+  }
+}

package/src/hash-bytes.strategy.ts

@@ -0,0 +1,5 @@
+import type { Hash } from "./hash.vo";
+
+export interface HashBytesStrategy {
+  hash(content: ArrayBuffer): Promise<Hash>;
+}

package/src/hash-file-sha256.adapter.ts

@@ -1,12 +1,12 @@
 import * as tools from "@bgord/tools";
 import type { FileInspectionPort } from "./file-inspection.port";
-import type { FileReaderTextPort } from "./file-reader-text.port";
-import type { HashContentStrategy } from "./hash-content.strategy";
+import type { FileReaderRawPort } from "./file-reader-raw.port";
+import type { HashBytesStrategy } from "./hash-bytes.strategy";
 import type { HashFilePort, HashFileResult } from "./hash-file.port";
 
 type Dependencies = {
-  HashContent: HashContentStrategy;
-  FileReaderText: FileReaderTextPort;
+  HashBytes: HashBytesStrategy;
+  FileReaderRaw: FileReaderRawPort;
   FileInspection: FileInspectionPort;
   MimeRegistry: tools.MimeRegistry;
 };
@@ -22,8 +22,8 @@ export class HashFileSha256Adapter implements HashFilePort {
 
     const size = await this.deps.FileInspection.size(path);
     const lastModified = await this.deps.FileInspection.lastModified(path);
-    const text = await this.deps.FileReaderText.read(path);
+    const bytes = await this.deps.FileReaderRaw.read(path);
 
-    return { etag: await this.deps.HashContent.hash(text), size, lastModified, mime };
+    return { etag: await this.deps.HashBytes.hash(bytes), size, lastModified, mime };
   }
 }

package/src/idempotency-store-cache.adapter.ts

@@ -7,6 +7,7 @@ type Dependencies = { CacheRepository: CacheRepositoryPort };
 export class IdempotencyStoreCacheAdapter implements IdempotencyStorePort {
   constructor(private readonly deps: Dependencies) {}
 
+  // Non-atomic get-then-set: concurrent claims of the same subject can both succeed
   async claim(subject: Hash): Promise<boolean> {
     const processed = await this.deps.CacheRepository.get(subject);
 

package/src/index.ts

@@ -96,6 +96,7 @@ export * from "./crypto-key-provider-memory.adapter";
 export * from "./crypto-key-provider-noop.adapter";
 export * from "./crypto-key-provider-with-memo.adapter";
 export * from "./csv.types";
+export * from "./csv-formula-sanitizer.service";
 export * from "./csv-parser.port";
 export * from "./csv-parser-noop.adapter";
 export * from "./csv-stringifier.port";
@@ -119,6 +120,7 @@ export * from "./environment-loader-encrypted.adapter";
 export * from "./environment-loader-noop.adapter";
 export * from "./environment-loader-process.adapter";
 export * from "./environment-loader-process-safe.adapter";
+export * from "./environment-loader-with-memo.adapter";
 export * from "./error.handler";
 export * from "./error-classifier.strategy";
 export * from "./error-classifier-http-exception-hono.strategy";
@@ -212,6 +214,9 @@ export * from "./handler-with-logger.strategy";
 export * from "./handler-with-logger-safe.strategy";
 export * from "./hash.vo";
 export * from "./hash-bucket.vo";
+export * from "./hash-bytes.strategy";
+export * from "./hash-bytes-noop.strategy";
+export * from "./hash-bytes-sha256.strategy";
 export * from "./hash-content.strategy";
 export * from "./hash-content-noop.strategy";
 export * from "./hash-content-sha256.strategy";

package/src/job-queue.adapter.ts

@@ -34,10 +34,18 @@ export class JobQueueAdapter<Job extends GenericJob> implements JobQueuePort<Job
 
   async claim(limit: tools.IntegerPositiveType): Promise<ReadonlyArray<Job>> {
     const jobs = await this.config.claimer.claim(this.config.registry.names, limit);
+    const valid: Array<Job> = [];
 
-    return jobs
-      .map((job) => ({ ...job, payload: this.config.serializer.deserialize(job.payload) }))
-      .map((job) => this.config.registry.validate(job));
+    for (const job of jobs) {
+      try {
+        valid.push(
+          this.config.registry.validate({ ...job, payload: this.config.serializer.deserialize(job.payload) }),
+        );
+      } catch {
+        await this.config.failer.fail(job.id);
+      }
+    }
+    return valid;
   }
 
   async complete(id: GenericJob["id"]): Promise<void> {

package/src/markdown-generator.adapter.ts

@@ -2,7 +2,16 @@
 import type { MarkdownGeneratorPort } from "./markdown-generator.port";
 
 export class MarkdownGeneratorAdapter implements MarkdownGeneratorPort {
+  private static readonly ALLOWED_SCHEMES = ["http", "https", "mailto"];
+
   generate(template: string): string {
-    return Bun.markdown.html(template, { tagFilter: true, noHtmlBlocks: true, noHtmlSpans: true });
+    const html = Bun.markdown.html(template, { tagFilter: true, noHtmlBlocks: true, noHtmlSpans: true });
+
+    return html.replace(/ href="([^"]*)"/g, (attribute, url: string) => {
+      const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(url)?.[1]?.toLowerCase();
+
+      if (scheme === undefined || MarkdownGeneratorAdapter.ALLOWED_SCHEMES.includes(scheme)) return attribute;
+      return ' href="#"';
+    });
   }
 }

package/src/redactor-key.vo.ts

@@ -0,0 +1,15 @@
+export class RedactorKey {
+  private constructor(private readonly value: string) {}
+
+  static fromString(candidate: string): RedactorKey {
+    return new RedactorKey(candidate.toLowerCase().replace(/[_-]/g, ""));
+  }
+
+  get(): string {
+    return this.value;
+  }
+
+  matches(another: RedactorKey): boolean {
+    return this.value === another.value;
+  }
+}

package/src/redactor-mask.strategy.ts

@@ -1,22 +1,27 @@
 /* cspell:disable */
 import * as tools from "@bgord/tools";
 import type { RedactorStrategy } from "./redactor.strategy";
+import { RedactorKey } from "./redactor-key.vo";
 
 export class RedactorMask implements RedactorStrategy {
   static readonly DEFAULT_KEYS: ReadonlyArray<string> = [
     "authorization",
+    "proxy-authorization",
     "cookie",
     "set-cookie",
     "x-api-key",
+    "x-auth-token",
     "apikey",
     "token",
     "accesstoken",
     "refreshtoken",
+    "idtoken",
     "password",
     "currentpassword",
     "newpassword",
     "passwordconfirmation",
     "clientsecret",
+    "privatekey",
     "secret",
     "otp",
     "code",
@@ -25,12 +30,14 @@ export class RedactorMask implements RedactorStrategy {
   private readonly keys: Set<string>;
 
   constructor(keys?: ReadonlyArray<string>) {
-    this.keys = new Set((keys?.length ? keys : RedactorMask.DEFAULT_KEYS).map((key) => key.toLowerCase()));
+    this.keys = new Set(
+      (keys?.length ? keys : RedactorMask.DEFAULT_KEYS).map((key) => RedactorKey.fromString(key).get()),
+    );
   }
 
   redact<T>(input: T): T {
     return tools.deepCloneWith(input, (_value, key) =>
-      typeof key === "string" && this.keys.has(key.toLowerCase()) ? "***" : undefined,
+      typeof key === "string" && this.keys.has(RedactorKey.fromString(key).get()) ? "***" : undefined,
     );
   }
 }