@cloudbitmaps/gcs 0.21.0 → 0.22.0

package/README.md

@@ -14,7 +14,14 @@ second service to run.
 pnpm add @cloudbitmaps/roaring @cloudbitmaps/gcs
 ```
 
-On npm 12 and pnpm 10 and later, allow `roaring`'s one install script first, or the install exits 0 and the package throws at `import`. Put this in your `package.json`: `{ "allowScripts": { "roaring": true }, "pnpm": { "onlyBuiltDependencies": ["roaring"] } }`. npm 11 runs the script but warns until you allow it the same way; pnpm 9 needs nothing extra. [Details](https://github.com/cloudbitmaps/cloudbitmaps/blob/main/docs/guide/getting-started.md#cannot-find-module-buildreleaseroaringnode-after-a-successful-install).
+`roaring` needs its one install script to fetch its native binary, and newer clients run a dependency's script only if you allow it. Allow it before you install:
+
+- **npm 12:** add `{ "allowScripts": { "roaring": true } }` to your `package.json`. Without it the install exits 0 and the package throws at `import`. npm 11 runs the script but warns until you allow it the same way.
+- **pnpm 11 and later:** put `allowBuilds: { roaring: true }` in a `pnpm-workspace.yaml` beside your `package.json`. Those versions no longer read the `package.json` `pnpm` key. Without it the install exits 1 with `ERR_PNPM_IGNORED_BUILDS`.
+- **pnpm 10:** add `{ "pnpm": { "onlyBuiltDependencies": ["roaring"] } }` to your `package.json`. Without it the install exits 0 and the package throws at `import`.
+- **pnpm 9:** nothing extra.
+
+[Details](https://github.com/cloudbitmaps/cloudbitmaps/blob/main/docs/guide/getting-started.md#cannot-find-module-buildreleaseroaringnode-after-a-successful-install).
 
 `@google-cloud/storage` (`^7 || ^8`) is a real dependency of this package, so installing it is the whole step.
 `@cloudbitmaps/core`, the engine underneath, arrives with it and you never name it.
@@ -109,6 +116,30 @@ It builds its own client from Application Default Credentials. Any other key is
   store's clock).
 
 The [production checklist](https://github.com/cloudbitmaps/cloudbitmaps/blob/main/docs/guide/production.md) covers each item, and the ones every backend shares: backups of the data and the registry, and a schedule for your loads.
+- **The driver redacts the credentials it recognises from an error before it throws it.** The SDK keeps the response it
+  got on the error (`response`), and through it the request it sent, with the bearer token in its `Authorization`
+  header, and the HTTP agent it shares with other calls; a resumable upload's or a token request's error keeps the
+  request's `config`. On a download, and wherever a body lists no errors, the SDK makes the response body the error's
+  message, so a proxy's page or a JSON body that quotes the request puts the token in the message. In the error the
+  driver throws, the value under a credential's name is replaced by `[redacted]` (`authorization`,
+  `x-goog-encryption-key`, `x-goog-api-key`, `X-Goog-Signature`, `X-Goog-Credential`, `access_token`, `refresh_token`,
+  `client_secret`, `private_key` and the like; a service account's `client_email` and `private_key_id` are kept), and so
+  are the value after one in a header list or under one in a map, the value beside one in a record (a `{ name, value }`
+  pair, a `{ th, td }` row; a number, a boolean, and the `message`, `reason` and `location` of a Google error item are
+  kept), and, anywhere in its text, a credential header line; an `Authorization` value, an encryption key, an API key,
+  an OAuth token or client secret, or a signed URL's signature or credential after its name; a cookie header's value
+  after its name; a bearer token after its scheme; a Google access token (`ya29.`) or a JWT on its own; a V2 signed
+  URL's `Signature=`; a PEM private key's body; the text of an element named for a credential, such as the
+  `<CanonicalRequest>` a service quotes back; and the text of the cell after one that names a credential (a
+  `<th>`/`<td>` row, a `<dt>`/`<dd>` pair, after a heading or a caption too). A credential in another form is not
+  recognised (a header table laid out by column, a user and password written into a URL, a colon written as an HTML
+  entity such as `&colon;` in a body a download quotes as it came), and a text these steps cannot finish is replaced
+  whole. An SDK error that carries its transport or shows a credential, and every error it reaches (its `cause` chain,
+  an `AggregateError`'s `errors`), is thrown as a copy: a native error with the same prototype, name, message, stack,
+  `code`, `status` and `errors`, with `response` reduced to its status and status text, so classification is unchanged,
+  without `config`, the request, its agent or socket, any function or accessor property, or anything nested deeper than
+  ten levels. The live error is never changed, and an error that holds only plain data and shows no credential is thrown
+  as it is.
 
 ## Documentation
 

package/dist/backend.d.ts

@@ -1,16 +1,10 @@
-/**
- * `GcsStorage` — the Google Cloud Storage backend as one object: generations and pointer, one bucket, stated once.
- *
- * See {@link StorageBackend} for why the two halves are configured together rather than separately.
- *
- * **A note on the word.** `@google-cloud/storage` names its own client class `Storage`, so the driver option
- * that takes it is also called `storage` — which, since this library calls its durable tier storage too, reads
- * as the same word meaning two things. That is why this class builds the client itself: `new GcsStorage({ bucket })`
- * never makes you write `{ storage: storage }`. Supply `client` when you need your own.
- */
 import { STORAGE_BACKEND } from '@cloudbitmaps/core/driver-kit';
 import type { IRegistryDriver, IStorageDriver, StorageBackend } from '@cloudbitmaps/core/driver-kit';
 import { Storage as GcsClient } from '@google-cloud/storage';
+/**
+ * What {@link GcsStorage} takes: a `bucket`, and either a `client` or the two settings that build one (`projectId`,
+ * `apiEndpoint`), never both.
+ */
 export interface GcsStorageOptions {
     /** Target bucket (must already exist). */
     readonly bucket: string;
@@ -77,6 +71,16 @@ export interface GcsStorageOptions {
  * for a client pointed at an emulator that is production traffic from a wiring typo.
  */
 export declare const GCS_STORAGE_OPTION_KEYS: readonly ["bucket", "prefix", "client", "projectId", "apiEndpoint", "maxObjectBytes", "simpleUploadThresholdBytes", "now", "readTimeoutMs", "conditionalDelete"];
+/**
+ * `GcsStorage` — the Google Cloud Storage backend as one object: generations and pointer, one bucket, stated once.
+ *
+ * See {@link StorageBackend} for why the two halves are configured together rather than separately.
+ *
+ * **A note on the word.** `@google-cloud/storage` names its own client class `Storage`, so the driver option
+ * that takes it is also called `storage` — which, since this library calls its durable tier storage too, reads
+ * as the same word meaning two things. That is why this class builds the client itself: `new GcsStorage({ bucket })`
+ * never makes you write `{ storage: storage }`. Supply `client` when you need your own.
+ */
 export declare class GcsStorage implements StorageBackend {
     /** Cross-bundle brand, stamped non-enumerably in the constructor so a spread cannot carry it. */
     readonly [STORAGE_BACKEND]: true;

package/dist/index.js

@@ -13,14 +13,12 @@ function defined(values) {
 
 // src/storage.ts
 import {
+  errorKind,
   NotFoundError,
   TransientError as TransientError2,
   ValidationError as ValidationError3,
   WriteConflictError,
   concatBytes,
-  isNotFoundError,
-  isValidationError,
-  isWriteConflictError,
   normalizeObjectPrefix,
   parseGenerationFromKey,
   requireBool,
@@ -121,7 +119,8 @@ function transientFaultMessage(err) {
 }
 
 // src/scrub-error.ts
-var DROPPED = /* @__PURE__ */ new Set([
+import { types } from "node:util";
+var TRANSPORT = /* @__PURE__ */ new Set([
   "request",
   "agent",
   "socket",
@@ -131,73 +130,349 @@ var DROPPED = /* @__PURE__ */ new Set([
   "res",
   "config"
 ]);
-var CREDENTIAL_NAME = /^(?:proxy-)?authorization$|^cookie$|^set-cookie$|^x-api-key$/i;
-var CREDENTIAL_LINES = /^((?:proxy-)?authorization|cookie|set-cookie|x-api-key):[^\r\n]*/gim;
+var RESPONSE_FIELDS = ["status", "statusText", "statusCode", "statusMessage"];
+var CREDENTIAL_NAMES = [
+  "authorization",
+  "proxy-authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "x-goog-api-key",
+  "x-goog-encryption-key",
+  "x-goog-copy-source-encryption-key",
+  "encryption-key",
+  "encryption-key-base64",
+  "x-goog-signature",
+  "x-goog-credential",
+  "signature",
+  "signature-provided",
+  "canonical-request",
+  "token",
+  "access-token",
+  "refresh-token",
+  "id-token",
+  "subject-token",
+  "client-secret",
+  "private-key",
+  "assertion"
+];
+var fold = (name) => name.trim().replace(/:$/, "").replace(/[-_]/g, "").toLowerCase();
+var CREDENTIAL_NAME = new Set(CREDENTIAL_NAMES.map(fold));
+var LONGEST_NAME = 64;
+var CREDENTIAL_LINES = /^((?:proxy-)?authorization|cookie|set-cookie|x-api-key|x-goog-api-key|x-goog-(?:copy-source-)?encryption-key):[^\r\n]*/gim;
+var AUTHORIZATION_VALUE = /((?:proxy-)?authorization\\?["']?\s*(?::|=|%3D)\s*\\?["']?)(?:[A-Za-z][\w-]*(?:\s+|%20|\+))?[^\s&"'<>\\,;]+/gi;
+var COOKIE_VALUE = /(?<![\w-])((?:set-)?cookie\\?["']?\s*:\s*\\?["']?)[^\r\n"'<>\\]+/gi;
+var NAMED = "x-goog-(?:copy-source-)?encryption-key|x-goog-api-key|x-goog-signature|x-goog-credential|(?:access|refresh|id|subject)[-_]token|client[-_]secret";
+var NAMED_SECRET = new RegExp(
+  `((?:${NAMED})\\\\?["']?\\s*(?::|=|%3D)\\s*\\\\?["']?)[^\\s&"'<>\\\\,;]+`,
+  "gi"
+);
+var BEARER = /\b(Bearer)(\s+|%20|\+)(?=[A-Za-z0-9\-._~+/]{16})[A-Za-z0-9\-._~+/]+=*/gi;
+var TOKEN_TEXT = /ya29\.(?=[A-Za-z0-9_.-]{16})[A-Za-z0-9_.-]+|(?<![A-Za-z0-9_-])eyJ(?=[A-Za-z0-9_-]{8})[A-Za-z0-9_-]+\.eyJ(?=[A-Za-z0-9_-]{8})[A-Za-z0-9_-]+\.(?=[A-Za-z0-9_-]{16})[A-Za-z0-9_-]+/g;
+var SIGNATURE_NAME = /Signature(?:=|%3D)/gi;
+var SIGNATURE_RUN = /[A-Za-z0-9+/=_.-]*/y;
+var SIGNATURE_MIN = 16;
+var PEM_OPEN = /-----BEGIN [A-Z0-9 ]{0,40}PRIVATE KEY-----/y;
+var PEM_CLOSE = /-----END [A-Z0-9 ]{0,40}PRIVATE KEY-----/y;
+var ELEMENT = /(<([A-Za-z][\w.:-]{0,63})>)([^<]*)(<\/\2>)/g;
+var CELL = /(<([A-Za-z][\w-]{0,15})\b[^<>]{0,256}>\s{0,32}([^<>\s](?:[^<>]{0,62}[^<>\s])?)\s{0,32}<\/\2\s{0,32}>(?:\s{0,32}<\/[A-Za-z][\w-]{0,15}\s{0,32}>){0,4}(?:\s{0,32}<[A-Za-z][\w-]{0,15}\b[^<>]{0,256}>){1,4})([^<]*)/g;
 var REDACTED = "[redacted]";
+var MAX_DEPTH = 10;
 var isPlain = (value) => {
   const proto = Object.getPrototypeOf(value);
   return proto === Object.prototype || proto === null;
 };
-function responseSummary(response) {
-  const out = {};
-  for (const key of ["status", "statusText"]) {
-    const value = response[key];
-    if (typeof value === "number" || typeof value === "string") out[key] = value;
+var isError = (value) => value instanceof Error || types.isNativeError(value);
+var isCredentialName = (text) => text.length <= LONGEST_NAME && CREDENTIAL_NAME.has(fold(text));
+function redactText(text) {
+  try {
+    const named = redactPrivateKeys(text).replace(CREDENTIAL_LINES, `$1: ${REDACTED}`).replace(AUTHORIZATION_VALUE, `$1${REDACTED}`).replace(COOKIE_VALUE, `$1${REDACTED}`).replace(NAMED_SECRET, `$1${REDACTED}`).replace(BEARER, `$1$2${REDACTED}`).replace(TOKEN_TEXT, REDACTED);
+    return redactCells(
+      redactSignatures(named).replace(
+        ELEMENT,
+        (whole, open, tag, inner, close) => isCredentialName(tag) && inner.trim() !== "" ? `${open}${REDACTED}${close}` : whole
+      )
+    );
+  } catch {
+    return REDACTED;
+  }
+}
+function redactPrivateKeys(text) {
+  let out = "";
+  let from = 0;
+  for (let at = text.indexOf("-----BEGIN "); at !== -1; at = text.indexOf("-----BEGIN ", Math.max(at + 1, from))) {
+    PEM_OPEN.lastIndex = at;
+    const open = PEM_OPEN.exec(text);
+    if (open === null) continue;
+    const body = at + open[0].length;
+    const end = text.indexOf("-----END", body);
+    let close = "";
+    if (end !== -1) {
+      PEM_CLOSE.lastIndex = end;
+      close = PEM_CLOSE.exec(text)?.[0] ?? "";
+    }
+    out += `${text.slice(from, body)}${REDACTED}${close}`;
+    from = end === -1 ? text.length : end + close.length;
+  }
+  return from === 0 ? text : out + text.slice(from);
+}
+function redactSignatures(text) {
+  let out = "";
+  let from = 0;
+  SIGNATURE_NAME.lastIndex = 0;
+  for (let m = SIGNATURE_NAME.exec(text); m !== null; m = SIGNATURE_NAME.exec(text)) {
+    const start = m.index + m[0].length;
+    let end = start;
+    for (; ; ) {
+      SIGNATURE_RUN.lastIndex = end;
+      SIGNATURE_RUN.exec(text);
+      end = SIGNATURE_RUN.lastIndex;
+      if (text[end] !== "%" || text.startsWith("%26", end)) break;
+      end += 1;
+    }
+    if (end - start >= SIGNATURE_MIN) {
+      out += `${text.slice(from, start)}${REDACTED}`;
+      from = end;
+    }
+    SIGNATURE_NAME.lastIndex = end;
+  }
+  return from === 0 ? text : out + text.slice(from);
+}
+function redactCells(text) {
+  let out = "";
+  let from = 0;
+  CELL.lastIndex = 0;
+  for (let m = CELL.exec(text); m !== null; m = CELL.exec(text)) {
+    const [whole, head, , name, value] = m;
+    if (isCredentialName(name) && value.trim() !== "") {
+      out += `${text.slice(from, m.index)}${head}${REDACTED}`;
+      from = m.index + whole.length;
+    } else {
+      CELL.lastIndex = m.index + 1;
+    }
   }
-  return out;
+  return from === 0 ? text : out + text.slice(from);
+}
+var OMIT = /* @__PURE__ */ Symbol("omit");
+var INDEX = /^(?:0|[1-9]\d*)$/;
+var isIndex = (key) => typeof key === "string" && INDEX.test(key) && Number(key) < 2 ** 32 - 1;
+function hasNamedKeys(value) {
+  if (!Array.isArray(value)) return Reflect.ownKeys(value).length > 0;
+  return Reflect.ownKeys(value).some((key) => key !== "length" && !isIndex(key));
+}
+function define(copy, key, value, enumerable) {
+  Object.defineProperty(copy, key, { value, writable: true, configurable: true, enumerable });
+}
+function copyOf(value, ctx, depth) {
+  if (typeof value === "string") {
+    const clean = redactText(value);
+    if (clean !== value) ctx.changed = true;
+    return clean;
+  }
+  if (typeof value === "function" || typeof value === "symbol") {
+    ctx.changed = true;
+    return OMIT;
+  }
+  if (typeof value !== "object" || value === null) return value;
+  if (ctx.copies.has(value)) return ctx.copies.get(value);
+  if (depth > MAX_DEPTH) {
+    ctx.changed = true;
+    return OMIT;
+  }
+  if (Array.isArray(value)) return copyList(value, ctx, depth);
+  if (value instanceof Map) return copyMap(value, ctx, depth);
+  if (value instanceof Set) return copySet(value, ctx, depth);
+  return copyRecord(value, ctx, depth);
+}
+function copyList(value, ctx, depth) {
+  const list = new Array(value.length);
+  ctx.copies.set(value, list);
+  if (hasNamedKeys(value)) ctx.changed = true;
+  let hidden = false;
+  let last = -1;
+  for (const key of Reflect.ownKeys(value)) {
+    if (!isIndex(key)) continue;
+    const index = Number(key);
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (descriptor === void 0 || !("value" in descriptor)) {
+      ctx.changed = true;
+      hidden = false;
+      continue;
+    }
+    const item = descriptor.value;
+    if (hidden && index === last + 1 && item != null) {
+      list[index] = REDACTED;
+      if (item !== REDACTED) ctx.changed = true;
+    } else {
+      const kept = copyOf(item, ctx, depth + 1);
+      if (kept === OMIT) delete list[index];
+      else list[index] = kept;
+    }
+    hidden = typeof item === "string" && isCredentialName(item);
+    last = index;
+  }
+  return list;
+}
+function copyMap(value, ctx, depth) {
+  const map = /* @__PURE__ */ new Map();
+  ctx.copies.set(value, map);
+  if (hasNamedKeys(value)) ctx.changed = true;
+  for (const [k, v] of value) {
+    const key = copyOf(k, ctx, depth + 1);
+    if (key === OMIT) continue;
+    if (typeof k === "string" && isCredentialName(k) && v != null) {
+      map.set(key, REDACTED);
+      if (v !== REDACTED) ctx.changed = true;
+      continue;
+    }
+    const kept = copyOf(v, ctx, depth + 1);
+    if (kept !== OMIT) map.set(key, kept);
+  }
+  return map;
+}
+function copySet(value, ctx, depth) {
+  const set = /* @__PURE__ */ new Set();
+  ctx.copies.set(value, set);
+  if (hasNamedKeys(value)) ctx.changed = true;
+  for (const v of value) {
+    const kept = copyOf(v, ctx, depth + 1);
+    if (kept !== OMIT) set.add(kept);
+  }
+  return set;
 }
-function clean(value, copies) {
-  if (typeof value === "string") return value.replace(CREDENTIAL_LINES, `$1: ${REDACTED}`);
-  if (typeof value !== "object" || value === null) {
-    return typeof value === "function" || typeof value === "symbol" ? void 0 : value;
-  }
-  if (copies.has(value)) return copies.get(value);
-  if (Array.isArray(value)) {
-    const list = [];
-    copies.set(value, list);
-    for (const item of value) list.push(clean(item, copies));
-    return list;
-  }
-  const isError = value instanceof Error;
-  if (!isError && !isPlain(value)) return void 0;
-  const copy = Object.create(Object.getPrototypeOf(value));
-  copies.set(value, copy);
+function copyRecord(value, ctx, depth) {
+  const errorLike = isError(value);
+  if (!errorLike && !isPlain(value)) {
+    ctx.changed = true;
+    return OMIT;
+  }
+  const copy = errorLike ? Object.setPrototypeOf(new Error(), Object.getPrototypeOf(value)) : Object.create(Object.getPrototypeOf(value));
+  ctx.copies.set(value, copy);
+  if (errorLike) delete copy.stack;
   for (const key of Reflect.ownKeys(value)) {
-    if (typeof key === "string" && DROPPED.has(key)) continue;
+    if (typeof key === "string" && TRANSPORT.has(key)) {
+      ctx.changed = true;
+    } else if (errorLike && key === "stack") {
+      copyStack(value, copy, ctx, depth);
+    } else {
+      copyField(value, copy, key, ctx, depth);
+    }
+  }
+  if (errorLike) keepSlotFields(value, copy, ctx, depth);
+  redactPairs(value, copy, errorLike, ctx);
+  return copy;
+}
+var DESCRIBING = /* @__PURE__ */ new Set([
+  "message",
+  "domain",
+  "reason",
+  "location",
+  "locationType",
+  "extendedHelp"
+]);
+function redactPairs(original, copy, errorLike, ctx) {
+  const names = Reflect.ownKeys(original).filter((key) => {
+    if (typeof key !== "string" || DESCRIBING.has(key)) return false;
+    const held = Object.getOwnPropertyDescriptor(original, key)?.value;
+    return typeof held === "string" && isCredentialName(held);
+  });
+  if (names.length === 0) return;
+  const values = errorLike ? names.filter((key) => /name$/i.test(key)).map((key) => `${key.slice(0, -4)}value`.toLowerCase()) : void 0;
+  for (const key of Reflect.ownKeys(copy)) {
+    if (typeof key !== "string" || names.includes(key) || DESCRIBING.has(key)) continue;
+    if (values !== void 0 && !values.includes(key.toLowerCase())) continue;
+    const descriptor = Object.getOwnPropertyDescriptor(copy, key);
+    if (descriptor?.value == null || descriptor.value === REDACTED) continue;
+    if (typeof descriptor.value !== "string" && typeof descriptor.value !== "object") continue;
+    define(copy, key, REDACTED, descriptor.enumerable ?? false);
+    ctx.changed = true;
+  }
+}
+function isSummary(value) {
+  return isPlain(value) && Reflect.ownKeys(value).every((key) => {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    const held = descriptor?.value;
+    return typeof key === "string" && RESPONSE_FIELDS.includes(key) && (typeof held === "number" || typeof held === "string");
+  });
+}
+function copyResponse(response, ctx, depth) {
+  if (isSummary(response)) return copyOf(response, ctx, depth);
+  ctx.changed = true;
+  const summary = {};
+  for (const key of RESPONSE_FIELDS) {
     let held;
     try {
-      held = value[key];
+      held = response[key];
     } catch {
       continue;
     }
-    const descriptor = Object.getOwnPropertyDescriptor(value, key);
-    let kept;
-    if (typeof key === "string" && CREDENTIAL_NAME.test(key)) kept = held == null ? held : REDACTED;
-    else if (key === "response" && typeof held === "object" && held !== null) {
-      kept = responseSummary(held);
-    } else kept = clean(held, copies);
-    if (kept === void 0 && held !== void 0) continue;
-    Object.defineProperty(copy, key, {
-      value: kept,
-      writable: true,
-      configurable: true,
-      enumerable: descriptor?.enumerable ?? true
-    });
+    if (typeof held === "number" || typeof held === "string") {
+      summary[key] = copyOf(held, ctx, depth + 1);
+    }
   }
-  return copy;
+  return summary;
 }
-function holdsTransport(err, seen) {
-  if (seen.has(err)) return false;
-  seen.add(err);
-  if (Object.getOwnPropertyNames(err).some((key) => DROPPED.has(key) || key === "response")) {
-    return true;
+function copyStack(original, copy, ctx, depth) {
+  let stack;
+  try {
+    stack = original.stack;
+  } catch {
+    return;
+  }
+  const kept = copyOf(stack, ctx, depth + 1);
+  if (kept !== OMIT) define(copy, "stack", kept, false);
+}
+function copyField(original, copy, key, ctx, depth) {
+  const descriptor = Object.getOwnPropertyDescriptor(original, key);
+  if (descriptor === void 0) return;
+  if (!("value" in descriptor)) {
+    ctx.changed = true;
+    return;
+  }
+  const name = typeof key === "string" ? redactText(key) : key;
+  if (name !== key) ctx.changed = true;
+  const held = descriptor.value;
+  let kept;
+  if (typeof key === "string" && isCredentialName(key) && held != null) {
+    kept = REDACTED;
+    if (held !== REDACTED) ctx.changed = true;
+  } else if (key === "response" && typeof held === "object" && held !== null) {
+    kept = copyResponse(held, ctx, depth + 1);
+  } else {
+    kept = copyOf(held, ctx, depth + 1);
+    if (kept === OMIT) return;
+  }
+  Object.defineProperty(copy, name, {
+    value: kept,
+    writable: descriptor.writable ?? true,
+    configurable: true,
+    enumerable: descriptor.enumerable ?? false
+  });
+}
+function keepSlotFields(original, copy, ctx, depth) {
+  for (const key of ["name", "message", "code"]) {
+    if (Object.prototype.hasOwnProperty.call(original, key)) continue;
+    let held;
+    try {
+      held = original[key];
+    } catch {
+      continue;
+    }
+    let read = OMIT;
+    try {
+      read = copy[key];
+    } catch {
+    }
+    if (read === held) continue;
+    const kept = copyOf(held, ctx, depth + 1);
+    if (kept !== OMIT) define(copy, key, kept, false);
   }
-  const cause = err.cause;
-  return typeof cause === "object" && cause !== null && holdsTransport(cause, seen);
 }
 function scrubCredentials(err) {
   if (typeof err !== "object" || err === null) return err;
-  return holdsTransport(err, /* @__PURE__ */ new Set()) ? clean(err, /* @__PURE__ */ new WeakMap()) : err;
+  const ctx = { copies: /* @__PURE__ */ new WeakMap(), changed: false };
+  const copy = copyOf(err, ctx, 0);
+  return ctx.changed && copy !== OMIT ? copy : err;
 }
 
 // src/bucket-presence.ts
@@ -415,6 +690,10 @@ var REAL_TIME = {
   sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
 };
 var REAL_RNG = { next: () => Math.random() };
+function isTypedPassThrough(err) {
+  const kind = errorKind(err);
+  return kind === "ValidationError" || kind === "WriteConflictError" || kind === "NotFoundError";
+}
 var DEFAULT_UPLOAD_THRESHOLD_BYTES = 8 * 1024 * 1024;
 var GcsStorageDriver = class {
   storage;
@@ -486,7 +765,7 @@ var GcsStorageDriver = class {
           `generation already exists (write-once): ${key.segment}.${key.generation}`
         );
       }
-      if (isValidationError(err) || isWriteConflictError(err) || isNotFoundError(err)) throw err;
+      if (isTypedPassThrough(err)) throw err;
       if (isNotFound(err)) await this.presence.confirm();
       throw this.mapError(err);
     }
@@ -707,7 +986,7 @@ var GcsStorageDriver = class {
   /** Map GCS read errors to the driver vocabulary; pass everything else through {@link mapError}. */
   mapReadError(err, key) {
     err = scrubCredentials(err);
-    if (isValidationError(err)) return err;
+    if (errorKind(err) === "ValidationError") return err;
     if (isNotFound(err))
       return new NotFoundError(`no such generation: ${key.segment}.${key.generation}`);
     if (isInvalidRange(err)) {