@capxul/observability 4.2.0 → 4.20.0-beta.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/observability",
-  "version": "4.2.0",
+  "version": "4.20.0-beta.2",
   "private": false,
   "repository": {
     "type": "git",
@@ -27,7 +27,7 @@
     "access": "public"
   },
   "dependencies": {
-    "effect": "4.0.0-beta.105"
+    "effect": "4.0.0-rc.112"
   },
   "devDependencies": {
     "@typescript/native": "npm:typescript@7.0.2",

package/dist/src-CWfRYsBI.mjs

@@ -1,302 +0,0 @@
-//#region ../errors/src/secret-material.ts
-const CREDENTIAL_FIELDS = /* @__PURE__ */ new Set([
-	"password",
-	"passwd",
-	"pwd",
-	"pass",
-	"passphrase",
-	"currentpassword",
-	"newpassword",
-	"confirmpassword",
-	"passwordconfirmation",
-	"passwordhash",
-	"hashedpassword",
-	"pin",
-	"privatekey",
-	"walletprivatekey",
-	"secretkey",
-	"signingkey",
-	"signingsecret",
-	"seed",
-	"seedphrase",
-	"mnemonic",
-	"recoveryphrase",
-	"recovery",
-	"recoverycode",
-	"recoverycodes",
-	"keyshare",
-	"signingmaterial",
-	"recoverymaterial",
-	"privatekeybytes",
-	"signingprivatekey",
-	"encryptionkey",
-	"decryptionkey",
-	"authtoken",
-	"apitoken",
-	"bearertoken",
-	"oauthtoken",
-	"csrftoken",
-	"clientassertion",
-	"token",
-	"accesstoken",
-	"refreshtoken",
-	"idtoken",
-	"sessiontoken",
-	"session",
-	"sessionkey",
-	"sessionsecret",
-	"authsessionid",
-	"sessioncredential",
-	"sessioncredentials",
-	"sessioncookie",
-	"auth",
-	"authentication",
-	"authorization",
-	"proxyauthorization",
-	"cookie",
-	"cookies",
-	"setcookie",
-	"apikey",
-	"xapikey",
-	"xauthtoken",
-	"clientsecret",
-	"secret",
-	"secrets",
-	"credential",
-	"credentials",
-	"signature",
-	"otp",
-	"otpcode",
-	"totpsecret",
-	"onetimecode",
-	"onetimepassword",
-	"verificationcode",
-	"authcode",
-	"authorizationcode",
-	"oauthcode",
-	"codeverifier"
-]);
-/** Match credential fields by meaning, without hiding token addresses or replay IDs. */
-function isCredentialField(name, context) {
-	const normalized = name.toLowerCase().replace(/[^a-z0-9]/gu, "");
-	return CREDENTIAL_FIELDS.has(normalized) || /(?:password(?:hash)?|passwd|passphrase|privatekey|signingkey|apikey|clientsecret|accesstoken|refreshtoken|sessiontoken)$/u.test(normalized) || context === "authentication" && (normalized === "code" || normalized === "sessionid") || context === "header" && /(?:token|secret|apikey|privatekey|signingkey|password|authorization|cookie|session)$/u.test(normalized);
-}
-function decodeUrlComponent(text) {
-	try {
-		return decodeURIComponent(text);
-	} catch {
-		return text;
-	}
-}
-/** Preserve URL diagnostics while removing credentials from their declared components. */
-function redactUrlSecrets(value, source) {
-	try {
-		const absolute = /^[a-z][a-z0-9+.-]*:/iu.test(value);
-		const protocolRelative = value.startsWith("//");
-		const url = new URL(value, "https://redaction.invalid");
-		if (url.protocol !== "https:" && url.protocol !== "http:") return maskText(value);
-		let changed = url.username.length > 0 || url.password.length > 0;
-		const maskParams = (params) => new URLSearchParams(Array.from(params, ([name, entry]) => {
-			const safeName = maskText(name);
-			const safeEntry = isCredentialField(name) || /^(?:code|draft|__posthog)$/iu.test(name) ? "[REDACTED]" : maskText(entry);
-			changed ||= safeName !== name || safeEntry !== entry;
-			return [safeName, safeEntry];
-		})).toString();
-		const provider = source !== void 0 || /(?:^|\.)(?:alchemy\.com|alchemyapi\.io|infura\.io)$/iu.test(url.hostname);
-		const segments = (absolute || protocolRelative ? url.pathname : value.split(/[?#]/u)[0] ?? "").split("/");
-		const path = segments.map((segment, index) => {
-			const decoded = decodeUrlComponent(segment);
-			const masked = provider && /^v[23]$/u.test(decodeUrlComponent(segments[index - 1] ?? "")) && decoded.length > 0 ? "[REDACTED]" : maskText(decoded);
-			changed ||= masked !== decoded;
-			return masked === decoded ? segment : encodeURIComponent(masked);
-		}).join("/");
-		const query = maskParams(url.searchParams);
-		const fragment = url.hash.slice(1);
-		const decodedFragment = decodeUrlComponent(fragment);
-		const maskedFragment = maskText(decodedFragment);
-		changed ||= maskedFragment !== decodedFragment;
-		const fragmentQuery = fragment.indexOf("?");
-		const fragmentPath = fragment.slice(0, fragmentQuery);
-		const maskedFragmentPath = maskText(decodeUrlComponent(fragmentPath));
-		changed ||= maskedFragmentPath !== decodeUrlComponent(fragmentPath);
-		const hash = fragmentQuery >= 0 ? `${maskedFragmentPath === decodeUrlComponent(fragmentPath) ? fragmentPath : encodeURIComponent(maskedFragmentPath)}?${maskParams(new URLSearchParams(fragment.slice(fragmentQuery + 1)))}` : fragment.includes("=") ? maskParams(new URLSearchParams(fragment)) : maskedFragment === decodedFragment ? fragment : encodeURIComponent(maskedFragment);
-		const origin = absolute ? url.origin : protocolRelative ? `//${url.host}` : "";
-		if (!changed) return value;
-		return `${origin}${path}${query ? `?${query}` : ""}${hash ? `#${hash}` : ""}`;
-	} catch {
-		return maskText(value.replace(/(https?:\/\/)[^/\s@]+@/giu, "$1[REDACTED]@").replace(/([?&#])([^=&#]+)=([^&#]*)/gu, (whole, separator, name) => isCredentialField(decodeUrlComponent(name)) || /^(?:code|draft|__posthog)$/iu.test(decodeUrlComponent(name)) ? `${separator}${name}=[REDACTED]` : whole));
-	}
-}
-const JSON_FIELD = /("(?:[^"\\]|\\.)*")(\s*:\s*)("(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null)/gu;
-const PROSE_FIELD = /(?=(\b([A-Za-z][A-Za-z0-9_-]*(?:[ \t]+[A-Za-z][A-Za-z0-9_-]*){0,3})\s*[:=]\s*((?:Bearer|Basic)[ \t]+[^\s,;"']+|"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s,;&"']+)))/gu;
-const EMBEDDED_URL = /(https?:\/\/[^\s"<>]*)/giu;
-function isSecretLabel(name) {
-	return isCredentialField(name) || /^request[ _-]?body$/iu.test(name);
-}
-const JSON_ENCODING_MAX = 8;
-const JSON_NESTING_MAX = 64;
-const JSON_KEY = /("(?:[^"\\]|\\.)*")\s*:/gu;
-const JSON_CONTAINER_START = /(?:\{\s*["}]|\[\s*[[\]{}"0-9tfn-])/uy;
-function hasSecretJsonKey(value) {
-	for (const match of value.matchAll(JSON_KEY)) try {
-		if (match[1] !== void 0 && isSecretLabel(JSON.parse(match[1]))) return true;
-	} catch {}
-	return false;
-}
-/** Project a complete fragment once. Never retry all of its nested substrings. */
-function projectJsonFragment(value, encodingDepth, overDepth) {
-	if (overDepth || encodingDepth >= JSON_ENCODING_MAX) return "[REDACTED]";
-	let parsed;
-	try {
-		parsed = JSON.parse(value);
-	} catch {
-		return hasSecretJsonKey(value) ? "[REDACTED]" : value;
-	}
-	try {
-		let changed = false;
-		const masked = JSON.stringify(parsed, (name, nested) => {
-			if (isSecretLabel(name)) {
-				changed ||= nested !== "[REDACTED]";
-				return "[REDACTED]";
-			}
-			if (typeof nested === "string") {
-				const projected = maskJsonFragments(nested, encodingDepth + 1);
-				changed ||= projected !== nested;
-				return projected;
-			}
-			return nested;
-		});
-		return changed ? masked : value;
-	} catch {
-		return "[REDACTED]";
-	}
-}
-/** Scan balanced object/array fragments once, respecting JSON quotes and escapes. */
-function maskJsonFragments(value, encodingDepth = 0) {
-	if (value.trimStart().startsWith("\"")) try {
-		const decoded = JSON.parse(value);
-		if (typeof decoded === "string") {
-			if (encodingDepth >= JSON_ENCODING_MAX) return "\"[REDACTED]\"";
-			const masked = maskJsonFragments(decoded, encodingDepth + 1);
-			return masked === decoded ? value : JSON.stringify(masked);
-		}
-	} catch {}
-	let output = "";
-	let cursor = 0;
-	let start = -1;
-	let depth = 0;
-	let overDepth = false;
-	let quoted = false;
-	let escaped = false;
-	for (let index = 0; index < value.length; index++) {
-		const character = value[index];
-		if (start < 0) {
-			JSON_CONTAINER_START.lastIndex = index;
-			if (!JSON_CONTAINER_START.test(value)) continue;
-			start = index;
-			depth = 1;
-			overDepth = false;
-			continue;
-		}
-		if (quoted) {
-			if (escaped) escaped = false;
-			else if (character === "\\") escaped = true;
-			else if (character === "\"") quoted = false;
-			continue;
-		}
-		if (character === "\"") quoted = true;
-		else if (character === "{" || character === "[") {
-			depth++;
-			overDepth ||= depth > JSON_NESTING_MAX;
-		} else if (character === "}" || character === "]") {
-			depth--;
-			if (depth !== 0) continue;
-			output += value.slice(cursor, start) + projectJsonFragment(value.slice(start, index + 1), encodingDepth, overDepth);
-			cursor = index + 1;
-			start = -1;
-		}
-	}
-	if (start >= 0) {
-		const fragment = value.slice(start);
-		output += value.slice(cursor, start) + (overDepth || hasSecretJsonKey(fragment) ? "[REDACTED]" : fragment);
-		cursor = value.length;
-	}
-	return output + value.slice(cursor);
-}
-function maskLabelledText(value) {
-	const jsonMasked = maskJsonFragments(value).replace(JSON_FIELD, (whole, quotedName, separator) => {
-		try {
-			return isSecretLabel(JSON.parse(quotedName)) ? `${quotedName}${separator}"[REDACTED]"` : whole;
-		} catch {
-			return whole;
-		}
-	});
-	let output = "";
-	let cursor = 0;
-	for (const match of jsonMasked.matchAll(PROSE_FIELD)) {
-		const [, whole, label, entry] = match;
-		if (whole === void 0 || label === void 0 || entry === void 0 || match.index < cursor || /^Bearer[ \t]+/iu.test(entry)) continue;
-		const words = label.split(/[ \t]+/u);
-		for (let index = 0; index < words.length; index++) {
-			const name = words.slice(index).join(" ");
-			if (isSecretLabel(name)) {
-				const prefix = words.slice(0, index).join(" ");
-				output += jsonMasked.slice(cursor, match.index) + `${prefix ? `${prefix} ` : ""}${name}=[REDACTED]`;
-				cursor = match.index + whole.length;
-				break;
-			}
-		}
-	}
-	return output + jsonMasked.slice(cursor);
-}
-const TOKEN_MASKS = [
-	[/\bBearer\s+(?!(?:realm|error|error_description|scope|authorization_uri|resource|claims)\s*=)[^\s,;"']+/giu, "Bearer [REDACTED]"],
-	[/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]"],
-	[/(^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?=$|[^a-fA-F0-9])/gu, "$1[REDACTED]"],
-	[/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu, "[REDACTED]"]
-];
-/** URL components and malformed URLs use this non-recursive masking layer. */
-function maskText(value) {
-	let text = maskLabelledText(value);
-	for (const [pattern, replacement] of TOKEN_MASKS) text = text.replace(pattern, replacement);
-	return text;
-}
-/** Mask credential fields and embedded URLs while preserving surrounding evidence. */
-function redactSecrets(value, source) {
-	return maskLabelledText(value).split(EMBEDDED_URL).map((part, index) => index % 2 === 1 ? redactUrlSecrets(part, source).replaceAll("%5BREDACTED%5D", "[REDACTED]") : maskText(part)).join("");
-}
-//#endregion
-//#region ../errors/src/errors.ts
-const CAPXUL_ERROR_CODES = [
-	"NOT_AUTHENTICATED",
-	"EMAIL_DELIVERY_FAILED",
-	"PROFILE_NOT_FOUND",
-	"SMART_ACCOUNT_MISSING",
-	"PLAYER_NOT_FOUND",
-	"ACCOUNT_NOT_FOUND",
-	"ACCOUNT_CLAIMED_BY_OTHER_SIGNER",
-	"PROVIDER_ERROR",
-	"CAPABILITY_UNAVAILABLE",
-	"INVALID_INPUT",
-	"ENV_MISSING",
-	"NOT_IMPLEMENTED",
-	"VERIFICATION_REQUIRED",
-	"INSUFFICIENT_BALANCE",
-	"INVALID_RECIPIENT",
-	"ROLE_PERMISSION_DENIED",
-	"TRANSACTION_FAILED",
-	"RATE_LIMITED",
-	"NETWORK_ERROR",
-	"UNKNOWN",
-	"OTP_EXPIRED",
-	"SIGNER_REJECTED",
-	"CANCELLED",
-	"WRONG_STATE",
-	"STALE_EPOCH",
-	"SUPERSEDED",
-	"WORK_DIED",
-	"ACTOR_STOPPED"
-];
-new Set(CAPXUL_ERROR_CODES);
-//#endregion
-export { redactUrlSecrets as i, isCredentialField as n, redactSecrets as r, CAPXUL_ERROR_CODES as t };