@composed-di/core 0.5.2-alpha → 0.5.3-alpha

package/dist/redactingEventListener.d.ts

@@ -1,35 +1,97 @@
 import type { DisposeContext, EventSpan, InitializeContext, MethodCallContext, ServiceModuleListener } from './serviceModuleListener';
 import type { ServiceKey } from './serviceKey';
 /**
- * The placeholder that replaces redacted values in event contexts and
- * outcomes.
+ * The placeholder that replaces a redacted value when no custom
+ * transform is given for it.
  */
-export declare const REDACTED_VALUE = "[redacted]";
+export declare const REDACTED_VALUE = "[REDACTED]";
+/**
+ * Custom masking for one included property, narrowed to the exact
+ * method named when {@link RedactionRuleBuilder.redact} is called.
+ * Omitting a side fully blanks it with {@link REDACTED_VALUE}; providing
+ * one lets you report a partial mask instead (e.g. the last 4 digits of
+ * a card number) — both always return a `string`, the masked
+ * representation to report in place of the real value.
+ */
+export type Mask<T, K extends Extract<keyof T, string>> = T[K] extends (...args: infer A) => infer R ? {
+    maskArgs?: (...args: A) => string;
+    maskResult?: (result: R) => string;
+} : never;
 /**
  * Marks a service — or specific properties of it — as sensitive, so the
- * values flowing through its events are replaced with {@link REDACTED_VALUE}.
+ * values flowing through its events are redacted. Returned by
+ * {@link RedactionRuleBuilder.build}, which is the only way to construct
+ * one — the `redactAll`/per-property merge logic lives entirely inside
+ * `maskArgs`/`maskResult`, so callers never need to know how a rule
+ * reached its decision, only what to do with it.
  */
 export interface RedactionRule<T> {
+    readonly key: ServiceKey<T>;
+    /**
+     * The args to report for a call to `functionName`: unchanged if not
+     * redacted, otherwise blanked or run through a custom `maskArgs`.
+     */
+    maskArgs(functionName: string, args: readonly unknown[]): readonly unknown[];
+    /**
+     * The value to report for a success outcome: unchanged if not
+     * redacted, otherwise blanked or run through a custom `maskResult`.
+     * Omit `functionName` to ask about the initialize result (the service
+     * instance itself), which only the rule's `redactAll` default touches.
+     */
+    maskResult(functionName: string | undefined, result: unknown): unknown;
+}
+/**
+ * Fluent, single-key rule builder returned by {@link redactionRule}.
+ * `redactAll`, `redact`, and `exclude` all merge into the same rule —
+ * call them in any combination, in any order; the more specific
+ * per-property calls (`redact`/`exclude`) always win over the blanket
+ * `redactAll` default for the properties they name.
+ *
+ * @example
+ * ```ts
+ * const rules = [
+ *   redactionRule(SecretClientKey)
+ *     .redactAll()
+ *     .build(), // whole service is sensitive
+ *   redactionRule(BillingKey)
+ *     .redactAll()
+ *     .redact('chargeCard', { maskResult: (card) => `card ending in ${card.number.slice(-4)}` })
+ *     .exclude('ping') // redact everything except this, with one custom mask
+ *     .build(),
+ *   redactionRule(VaultKey)
+ *     .redact('getSecret')
+ *     .build(), // only this call, nothing else
+ * ];
+ * ```
+ */
+export declare class RedactionRuleBuilder<T> {
+    private readonly key;
+    private redactAllFlag;
+    private readonly overrides;
+    constructor(key: ServiceKey<T>);
+    /** Redacts every property, plus the initialize result, by default. */
+    redactAll(): this;
     /**
-     * The service key whose values must be redacted. Matched by key
-     * identity, like everywhere else in the container.
+     * Marks one property (method) as redacted, with optional custom
+     * masking. Call repeatedly for several properties. Overrides
+     * `redactAll`/`exclude` for this specific property.
      */
-    key: ServiceKey<T>;
+    redact<K extends Extract<keyof T, string>>(name: K, mask?: Mask<T, K>): this;
     /**
-     * Property names to redact. Optional: when omitted, ALL properties of
-     * the service are redacted, along with its initialize result (the
-     * service instance itself may carry credentials or config).
+     * Marks one or more properties as explicitly NOT redacted, overriding
+     * `redactAll` for just these.
      */
-    properties?: Extract<keyof T, string>[];
+    exclude(...names: Extract<keyof T, string>[]): this;
+    build(): RedactionRule<any>;
 }
-export declare function redactionRule<T>(key: ServiceKey<T>, properties?: Extract<keyof T, string>[]): RedactionRule<T>;
+export declare function redactionRule<T>(key: ServiceKey<T>): RedactionRuleBuilder<T>;
 /**
  * A ServiceEventListener decorator that redacts sensitive values before
  * they reach the wrapped listener. Works with any implementation via
  * delegation: arguments in MethodCallContext and success values in
- * EventOutcome are replaced with {@link REDACTED_VALUE}, so the delegate
- * never sees the sensitive data — whatever it captures or exports is
- * already scrubbed.
+ * EventOutcome are replaced (wholesale, or via a custom transform)
+ * before the delegate ever sees them — whatever it captures or exports
+ * is already scrubbed.
  *
  * Failure outcomes are passed through unchanged so error reporting keeps
  * working; keep secrets out of error messages at the throwing site.
@@ -39,8 +101,9 @@ export declare function redactionRule<T>(key: ServiceKey<T>, properties?: Extrac
  * const listener = new RedactingEventListener(
  *   new OTELEventListener({ captureArguments: true, captureResults: true }),
  *   [
- *     { key: SecretClientKey }, // whole service is sensitive
- *     { key: VaultKey, properties: ['getSecret'] }, // only these calls
+ *     redactionRule(SecretClientKey).redactAll().build(), // whole service is sensitive
+ *     redactionRule(VaultKey).redact('getSecret').build(), // only this call
+ *     redactionRule(HealthKey).redactAll().exclude('ping').build(), // everything but this call
  *   ],
  * );
  * ```
@@ -52,6 +115,5 @@ export declare class RedactingEventListener implements ServiceModuleListener {
     onInitialize(context: InitializeContext): EventSpan | void;
     onDispose(context: DisposeContext): EventSpan | void;
     onMethodCall(context: MethodCallContext): EventSpan | void;
-    private isRedacted;
 }
 //# sourceMappingURL=redactingEventListener.d.ts.map

package/dist/redactingEventListener.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redactingEventListener.d.ts","sourceRoot":"","sources":["../src/redactingEventListener.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EAEd,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,cAAc,eAAe,CAAC;AAE3C;;;GAGG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B;;;OAGG;IACH,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAEnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;CACzC;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAE9G;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,sBAAuB,YAAW,qBAAqB;IAEhE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,EAAE,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE;IAGvD,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,IAAI;IAU1D,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,GAAG,IAAI;IAKpD,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,IAAI;IAc1D,OAAO,CAAC,UAAU;CAYnB"}
+{"version":3,"file":"redactingEventListener.d.ts","sourceRoot":"","sources":["../src/redactingEventListener.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EAEd,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,cAAc,eAAe,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,SAAS,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CACrE,GAAG,IAAI,EAAE,MAAM,CAAC,KACb,MAAM,CAAC,GACR;IACE,QAAQ,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC;IAClC,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;CACpC,GACD,KAAK,CAAC;AAeV;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAE5B;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,OAAO,EAAE,CAAC;IAE7E;;;;;OAKG;IACH,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;CACxE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,oBAAoB,CAAC,CAAC;IAIrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHhC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;gBAErC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;IAE/C,sEAAsE;IACtE,SAAS,IAAI,IAAI;IAKjB;;;;OAIG;IACH,MAAM,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI;IAK5E;;;OAGG;IACH,OAAO,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,IAAI;IAOnD,KAAK,IAAI,aAAa,CAAC,GAAG,CAAC;CAwC5B;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAE5E;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,sBAAuB,YAAW,qBAAqB;IAEhE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,EAAE,SAAS,aAAa,CAAC,GAAG,CAAC,EAAE;IAGvD,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,IAAI;IAK1D,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,GAAG,IAAI;IAKpD,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,IAAI;CAY3D"}

package/dist/redactingEventListener.js

@@ -1,22 +1,113 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RedactingEventListener = exports.REDACTED_VALUE = void 0;
+exports.RedactingEventListener = exports.RedactionRuleBuilder = exports.REDACTED_VALUE = void 0;
 exports.redactionRule = redactionRule;
 /**
- * The placeholder that replaces redacted values in event contexts and
- * outcomes.
+ * The placeholder that replaces a redacted value when no custom
+ * transform is given for it.
  */
-exports.REDACTED_VALUE = '[redacted]';
-function redactionRule(key, properties) {
-    return { key, properties };
+exports.REDACTED_VALUE = '[REDACTED]';
+/**
+ * Fluent, single-key rule builder returned by {@link redactionRule}.
+ * `redactAll`, `redact`, and `exclude` all merge into the same rule —
+ * call them in any combination, in any order; the more specific
+ * per-property calls (`redact`/`exclude`) always win over the blanket
+ * `redactAll` default for the properties they name.
+ *
+ * @example
+ * ```ts
+ * const rules = [
+ *   redactionRule(SecretClientKey)
+ *     .redactAll()
+ *     .build(), // whole service is sensitive
+ *   redactionRule(BillingKey)
+ *     .redactAll()
+ *     .redact('chargeCard', { maskResult: (card) => `card ending in ${card.number.slice(-4)}` })
+ *     .exclude('ping') // redact everything except this, with one custom mask
+ *     .build(),
+ *   redactionRule(VaultKey)
+ *     .redact('getSecret')
+ *     .build(), // only this call, nothing else
+ * ];
+ * ```
+ */
+class RedactionRuleBuilder {
+    constructor(key) {
+        this.key = key;
+        this.redactAllFlag = false;
+        this.overrides = {};
+    }
+    /** Redacts every property, plus the initialize result, by default. */
+    redactAll() {
+        this.redactAllFlag = true;
+        return this;
+    }
+    /**
+     * Marks one property (method) as redacted, with optional custom
+     * masking. Call repeatedly for several properties. Overrides
+     * `redactAll`/`exclude` for this specific property.
+     */
+    redact(name, mask) {
+        this.overrides[name] = Object.assign({ redacted: true }, mask);
+        return this;
+    }
+    /**
+     * Marks one or more properties as explicitly NOT redacted, overriding
+     * `redactAll` for just these.
+     */
+    exclude(...names) {
+        for (const name of names) {
+            this.overrides[name] = { redacted: false };
+        }
+        return this;
+    }
+    build() {
+        if (!this.redactAllFlag && Object.keys(this.overrides).length === 0) {
+            throw new Error(`redactionRule(${this.key.name}) has no effect: call .redactAll() and/or .redact(...) ` +
+                'before .build(), otherwise this rule never redacts anything.');
+        }
+        const redactAllFlag = this.redactAllFlag;
+        const overrides = this.overrides;
+        return {
+            key: this.key,
+            maskArgs(functionName, args) {
+                const override = overrides[functionName];
+                const redacted = override ? override.redacted : redactAllFlag;
+                if (!redacted) {
+                    return args;
+                }
+                return (override === null || override === void 0 ? void 0 : override.maskArgs)
+                    ? // A custom mask reports one string for the whole call,
+                        // rather than a value per argument.
+                        [override.maskArgs(...args)]
+                    : // Replace each argument rather than the whole array, so the
+                        // delegate still sees the call's arity.
+                        args.map(() => exports.REDACTED_VALUE);
+            },
+            maskResult(functionName, result) {
+                const override = functionName === undefined ? undefined : overrides[functionName];
+                const redacted = override ? override.redacted : redactAllFlag;
+                if (!redacted) {
+                    return result;
+                }
+                return (override === null || override === void 0 ? void 0 : override.maskResult)
+                    ? override.maskResult(result)
+                    : exports.REDACTED_VALUE;
+            },
+        };
+    }
+}
+exports.RedactionRuleBuilder = RedactionRuleBuilder;
+function redactionRule(key) {
+    return new RedactionRuleBuilder(key);
 }
 /**
  * A ServiceEventListener decorator that redacts sensitive values before
  * they reach the wrapped listener. Works with any implementation via
  * delegation: arguments in MethodCallContext and success values in
- * EventOutcome are replaced with {@link REDACTED_VALUE}, so the delegate
- * never sees the sensitive data — whatever it captures or exports is
- * already scrubbed.
+ * EventOutcome are replaced (wholesale, or via a custom transform)
+ * before the delegate ever sees them — whatever it captures or exports
+ * is already scrubbed.
  *
  * Failure outcomes are passed through unchanged so error reporting keeps
  * working; keep secrets out of error messages at the throwing site.
@@ -26,8 +117,9 @@ function redactionRule(key, properties) {
  * const listener = new RedactingEventListener(
  *   new OTELEventListener({ captureArguments: true, captureResults: true }),
  *   [
- *     { key: SecretClientKey }, // whole service is sensitive
- *     { key: VaultKey, properties: ['getSecret'] }, // only these calls
+ *     redactionRule(SecretClientKey).redactAll().build(), // whole service is sensitive
+ *     redactionRule(VaultKey).redact('getSecret').build(), // only this call
+ *     redactionRule(HealthKey).redactAll().exclude('ping').build(), // everything but this call
  *   ],
  * );
  * ```
@@ -39,10 +131,8 @@ class RedactingEventListener {
     }
     onInitialize(context) {
         var _a, _b;
-        // The initialize result is the service instance itself, so it is
-        // redacted only when the whole service is sensitive — a rule without
-        // `properties`.
-        return redactSpan((_b = (_a = this.delegate).onInitialize) === null || _b === void 0 ? void 0 : _b.call(_a, context), this.isRedacted(context.key));
+        const rule = this.rules.find((r) => r.key === context.key);
+        return redactSpan((_b = (_a = this.delegate).onInitialize) === null || _b === void 0 ? void 0 : _b.call(_a, context), rule);
     }
     onDispose(context) {
         var _a, _b;
@@ -51,39 +141,29 @@ class RedactingEventListener {
     }
     onMethodCall(context) {
         var _a, _b;
-        const redacted = this.isRedacted(context.key, context.functionName);
-        const span = (_b = (_a = this.delegate).onMethodCall) === null || _b === void 0 ? void 0 : _b.call(_a, redacted
-            ? // Replace each argument rather than the whole array, so the
-             Object.assign(Object.assign({}, context), { args: context.args.map(() => exports.REDACTED_VALUE) }) : context);
-        return redactSpan(span, redacted);
-    }
-    // 1. Si expiro el dbr `EXPIRED` el cron debe mandar a `FACE_MISMATCH`?
-    // 2. Si hubo un matchLevel intermediario el cron debe mandar a `FACE_MISMATCH`? (Probablemente no)
-    isRedacted(key, propertyName) {
-        return this.rules.some((rule) => {
-            var _a;
-            return rule.key === key &&
-                // A rule without `properties` redacts everything on the key,
-                // including initialize — where no property name is passed —
-                // while a rule with `properties` matches only those calls.
-                (rule.properties === undefined ||
-                    (propertyName !== undefined &&
-                        ((_a = rule.properties) === null || _a === void 0 ? void 0 : _a.includes(propertyName))));
-        });
+        const rule = this.rules.find((r) => r.key === context.key);
+        const span = (_b = (_a = this.delegate).onMethodCall) === null || _b === void 0 ? void 0 : _b.call(_a, rule
+            ? Object.assign(Object.assign({}, context), { args: rule.maskArgs(context.functionName, context.args) }) : context);
+        return redactSpan(span, rule, context.functionName);
     }
 }
 exports.RedactingEventListener = RedactingEventListener;
 /**
  * Wraps the delegate's EventSpan so success values are redacted before
- * `end` sees them. `run` (and any future fields) pass through untouched.
+ * `end` sees them, by delegating to the rule's `maskResult`. `run` (and
+ * any future fields) pass through untouched. `functionName` is omitted
+ * for the initialize result (the instance itself).
  */
-function redactSpan(span, redacted) {
-    if (!redacted || !(span === null || span === void 0 ? void 0 : span.end)) {
+function redactSpan(span, rule, functionName) {
+    if (!rule || !(span === null || span === void 0 ? void 0 : span.end)) {
         return span;
     }
     const end = span.end.bind(span);
     return Object.assign(Object.assign({}, span), { end: (outcome) => end(outcome.type === 'success'
-            ? { type: 'success', value: exports.REDACTED_VALUE }
+            ? {
+                type: 'success',
+                value: rule.maskResult(functionName, outcome.value),
+            }
             : outcome) });
 }
 //# sourceMappingURL=redactingEventListener.js.map

package/dist/redactingEventListener.js.map

@@ -1 +1 @@
-{"version":3,"file":"redactingEventListener.js","sourceRoot":"","sources":["../src/redactingEventListener.ts"],"names":[],"mappings":";;;AAmCA,sCAEC;AA3BD;;;GAGG;AACU,QAAA,cAAc,GAAG,YAAY,CAAC;AAqB3C,SAAgB,aAAa,CAAI,GAAkB,EAAE,UAAuC;IAC1F,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAa,sBAAsB;IACjC,YACmB,QAA+B,EAC/B,KAAoC;QADpC,aAAQ,GAAR,QAAQ,CAAuB;QAC/B,UAAK,GAAL,KAAK,CAA+B;IACpD,CAAC;IAEJ,YAAY,CAAC,OAA0B;;QACrC,iEAAiE;QACjE,qEAAqE;QACrE,gBAAgB;QAChB,OAAO,UAAU,CACf,MAAA,MAAA,IAAI,CAAC,QAAQ,EAAC,YAAY,mDAAG,OAAO,CAAC,EACrC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,OAAuB;;QAC/B,uEAAuE;QACvE,OAAO,MAAA,MAAA,IAAI,CAAC,QAAQ,EAAC,SAAS,mDAAG,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,YAAY,CAAC,OAA0B;;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAA,MAAA,IAAI,CAAC,QAAQ,EAAC,YAAY,mDACrC,QAAQ;YACN,CAAC,CAAC,4DAA4D;6CAEvD,OAAO,KAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,sBAAc,CAAC,IAC5D,CAAC,CAAC,OAAO,CACZ,CAAC;QACF,OAAO,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,uEAAuE;IACvE,mGAAmG;IAC3F,UAAU,CAAC,GAAoB,EAAE,YAAqB;QAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CACpB,CAAC,IAAI,EAAE,EAAE;;YACP,OAAA,IAAI,CAAC,GAAG,KAAK,GAAG;gBAChB,6DAA6D;gBAC7D,4DAA4D;gBAC5D,2DAA2D;gBAC3D,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS;oBAC5B,CAAC,YAAY,KAAK,SAAS;yBACzB,MAAA,IAAI,CAAC,UAAU,0CAAE,QAAQ,CAAC,YAAY,CAAC,CAAA,CAAC,CAAC,CAAA;SAAA,CAChD,CAAC;IACJ,CAAC;CACF;AA/CD,wDA+CC;AAED;;;GAGG;AACH,SAAS,UAAU,CACjB,IAAsB,EACtB,QAAiB;IAEjB,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,GAAG,CAAA,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,uCACK,IAAI,KACP,GAAG,EAAE,CAAC,OAAqB,EAAE,EAAE,CAC7B,GAAG,CACD,OAAO,CAAC,IAAI,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,sBAAc,EAAE;YAC5C,CAAC,CAAC,OAAO,CACZ,IACH;AACJ,CAAC"}
+{"version":3,"file":"redactingEventListener.js","sourceRoot":"","sources":["../src/redactingEventListener.ts"],"names":[],"mappings":";;;AA2KA,sCAEC;AAnKD;;;GAGG;AACU,QAAA,cAAc,GAAG,YAAY,CAAC;AA0D3C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAa,oBAAoB;IAI/B,YAA6B,GAAkB;QAAlB,QAAG,GAAH,GAAG,CAAe;QAHvC,kBAAa,GAAG,KAAK,CAAC;QACb,cAAS,GAAqC,EAAE,CAAC;IAEhB,CAAC;IAEnD,sEAAsE;IACtE,SAAS;QACP,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAqC,IAAO,EAAE,IAAiB;QACnE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAK,QAAQ,EAAE,IAAI,IAAK,IAAI,CAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,GAAG,KAAiC;QAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,CAAC,GAAG,CAAC,IAAI,yDAAyD;gBACrF,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAEjC,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,CAAC,YAAY,EAAE,IAAI;gBACzB,MAAM,QAAQ,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;gBACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC;gBAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,QAAQ;oBACvB,CAAC,CAAC,uDAAuD;wBACvD,oCAAoC;wBACpC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;oBAC9B,CAAC,CAAC,4DAA4D;wBAC5D,wCAAwC;wBACxC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,sBAAc,CAAC,CAAC;YACrC,CAAC;YACD,UAAU,CAAC,YAAY,EAAE,MAAM;gBAC7B,MAAM,QAAQ,GACZ,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC;gBAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,OAAO,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,UAAU;oBACzB,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;oBAC7B,CAAC,CAAC,sBAAc,CAAC;YACrB,CAAC;SACoB,CAAC;IAC1B,CAAC;CACF;AAzED,oDAyEC;AAED,SAAgB,aAAa,CAAI,GAAkB;IACjD,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAa,sBAAsB;IACjC,YACmB,QAA+B,EAC/B,KAAoC;QADpC,aAAQ,GAAR,QAAQ,CAAuB;QAC/B,UAAK,GAAL,KAAK,CAA+B;IACpD,CAAC;IAEJ,YAAY,CAAC,OAA0B;;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3D,OAAO,UAAU,CAAC,MAAA,MAAA,IAAI,CAAC,QAAQ,EAAC,YAAY,mDAAG,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,SAAS,CAAC,OAAuB;;QAC/B,uEAAuE;QACvE,OAAO,MAAA,MAAA,IAAI,CAAC,QAAQ,EAAC,SAAS,mDAAG,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,YAAY,CAAC,OAA0B;;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAA,MAAA,IAAI,CAAC,QAAQ,EAAC,YAAY,mDACrC,IAAI;YACF,CAAC,iCACM,OAAO,KACV,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,IAE3D,CAAC,CAAC,OAAO,CACZ,CAAC;QACF,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC;CACF;AA5BD,wDA4BC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CACjB,IAAsB,EACtB,IAAoC,EACpC,YAAqB;IAErB,IAAI,CAAC,IAAI,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,GAAG,CAAA,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,uCACK,IAAI,KACP,GAAG,EAAE,CAAC,OAAqB,EAAE,EAAE,CAC7B,GAAG,CACD,OAAO,CAAC,IAAI,KAAK,SAAS;YACxB,CAAC,CAAC;gBACE,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC;aACpD;YACH,CAAC,CAAC,OAAO,CACZ,IACH;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@composed-di/core",
   "private": false,
-  "version": "0.5.2-alpha",
+  "version": "0.5.3-alpha",
   "author": "Juan Herrera juanhr454@gmail.com",
   "type": "commonjs",
   "main": "./dist/index.js",

package/src/redactingEventListener.ts

@@ -9,41 +9,177 @@ import type {
 import type { ServiceKey } from './serviceKey';
 
 /**
- * The placeholder that replaces redacted values in event contexts and
- * outcomes.
+ * The placeholder that replaces a redacted value when no custom
+ * transform is given for it.
  */
-export const REDACTED_VALUE = '[redacted]';
+export const REDACTED_VALUE = '[REDACTED]';
+
+/**
+ * Custom masking for one included property, narrowed to the exact
+ * method named when {@link RedactionRuleBuilder.redact} is called.
+ * Omitting a side fully blanks it with {@link REDACTED_VALUE}; providing
+ * one lets you report a partial mask instead (e.g. the last 4 digits of
+ * a card number) — both always return a `string`, the masked
+ * representation to report in place of the real value.
+ */
+export type Mask<T, K extends Extract<keyof T, string>> = T[K] extends (
+  ...args: infer A
+) => infer R
+  ? {
+      maskArgs?: (...args: A) => string;
+      maskResult?: (result: R) => string;
+    }
+  : never;
+
+/**
+ * Per-property override, layered on top of a rule's `redactAll` default.
+ * `redacted: true` (from {@link RedactionRuleBuilder.redact}) redacts
+ * that property, optionally with a custom mask; `redacted: false` (from
+ * {@link RedactionRuleBuilder.exclude}) forces it to be left untouched
+ * regardless of `redactAll`.
+ */
+interface PropertyOverride {
+  redacted: boolean;
+  maskArgs?: (...args: any[]) => string;
+  maskResult?: (result: any) => string;
+}
 
 /**
  * Marks a service — or specific properties of it — as sensitive, so the
- * values flowing through its events are replaced with {@link REDACTED_VALUE}.
+ * values flowing through its events are redacted. Returned by
+ * {@link RedactionRuleBuilder.build}, which is the only way to construct
+ * one — the `redactAll`/per-property merge logic lives entirely inside
+ * `maskArgs`/`maskResult`, so callers never need to know how a rule
+ * reached its decision, only what to do with it.
  */
 export interface RedactionRule<T> {
+  readonly key: ServiceKey<T>;
+
   /**
-   * The service key whose values must be redacted. Matched by key
-   * identity, like everywhere else in the container.
+   * The args to report for a call to `functionName`: unchanged if not
+   * redacted, otherwise blanked or run through a custom `maskArgs`.
    */
-  key: ServiceKey<T>;
+  maskArgs(functionName: string, args: readonly unknown[]): readonly unknown[];
 
   /**
-   * Property names to redact. Optional: when omitted, ALL properties of
-   * the service are redacted, along with its initialize result (the
-   * service instance itself may carry credentials or config).
+   * The value to report for a success outcome: unchanged if not
+   * redacted, otherwise blanked or run through a custom `maskResult`.
+   * Omit `functionName` to ask about the initialize result (the service
+   * instance itself), which only the rule's `redactAll` default touches.
    */
-  properties?: Extract<keyof T, string>[];
+  maskResult(functionName: string | undefined, result: unknown): unknown;
 }
 
-export function redactionRule<T>(key: ServiceKey<T>, properties?: Extract<keyof T, string>[]): RedactionRule<T> {
-  return { key, properties };
+/**
+ * Fluent, single-key rule builder returned by {@link redactionRule}.
+ * `redactAll`, `redact`, and `exclude` all merge into the same rule —
+ * call them in any combination, in any order; the more specific
+ * per-property calls (`redact`/`exclude`) always win over the blanket
+ * `redactAll` default for the properties they name.
+ *
+ * @example
+ * ```ts
+ * const rules = [
+ *   redactionRule(SecretClientKey)
+ *     .redactAll()
+ *     .build(), // whole service is sensitive
+ *   redactionRule(BillingKey)
+ *     .redactAll()
+ *     .redact('chargeCard', { maskResult: (card) => `card ending in ${card.number.slice(-4)}` })
+ *     .exclude('ping') // redact everything except this, with one custom mask
+ *     .build(),
+ *   redactionRule(VaultKey)
+ *     .redact('getSecret')
+ *     .build(), // only this call, nothing else
+ * ];
+ * ```
+ */
+export class RedactionRuleBuilder<T> {
+  private redactAllFlag = false;
+  private readonly overrides: Record<string, PropertyOverride> = {};
+
+  constructor(private readonly key: ServiceKey<T>) {}
+
+  /** Redacts every property, plus the initialize result, by default. */
+  redactAll(): this {
+    this.redactAllFlag = true;
+    return this;
+  }
+
+  /**
+   * Marks one property (method) as redacted, with optional custom
+   * masking. Call repeatedly for several properties. Overrides
+   * `redactAll`/`exclude` for this specific property.
+   */
+  redact<K extends Extract<keyof T, string>>(name: K, mask?: Mask<T, K>): this {
+    this.overrides[name] = { redacted: true, ...mask };
+    return this;
+  }
+
+  /**
+   * Marks one or more properties as explicitly NOT redacted, overriding
+   * `redactAll` for just these.
+   */
+  exclude(...names: Extract<keyof T, string>[]): this {
+    for (const name of names) {
+      this.overrides[name] = { redacted: false };
+    }
+    return this;
+  }
+
+  build(): RedactionRule<any> {
+    if (!this.redactAllFlag && Object.keys(this.overrides).length === 0) {
+      throw new Error(
+        `redactionRule(${this.key.name}) has no effect: call .redactAll() and/or .redact(...) ` +
+          'before .build(), otherwise this rule never redacts anything.',
+      );
+    }
+
+    const redactAllFlag = this.redactAllFlag;
+    const overrides = this.overrides;
+
+    return {
+      key: this.key,
+      maskArgs(functionName, args) {
+        const override = overrides[functionName];
+        const redacted = override ? override.redacted : redactAllFlag;
+        if (!redacted) {
+          return args;
+        }
+        return override?.maskArgs
+          ? // A custom mask reports one string for the whole call,
+            // rather than a value per argument.
+            [override.maskArgs(...args)]
+          : // Replace each argument rather than the whole array, so the
+            // delegate still sees the call's arity.
+            args.map(() => REDACTED_VALUE);
+      },
+      maskResult(functionName, result) {
+        const override =
+          functionName === undefined ? undefined : overrides[functionName];
+        const redacted = override ? override.redacted : redactAllFlag;
+        if (!redacted) {
+          return result;
+        }
+        return override?.maskResult
+          ? override.maskResult(result)
+          : REDACTED_VALUE;
+      },
+    } as RedactionRule<any>;
+  }
+}
+
+export function redactionRule<T>(key: ServiceKey<T>): RedactionRuleBuilder<T> {
+  return new RedactionRuleBuilder(key);
 }
 
 /**
  * A ServiceEventListener decorator that redacts sensitive values before
  * they reach the wrapped listener. Works with any implementation via
  * delegation: arguments in MethodCallContext and success values in
- * EventOutcome are replaced with {@link REDACTED_VALUE}, so the delegate
- * never sees the sensitive data — whatever it captures or exports is
- * already scrubbed.
+ * EventOutcome are replaced (wholesale, or via a custom transform)
+ * before the delegate ever sees them — whatever it captures or exports
+ * is already scrubbed.
  *
  * Failure outcomes are passed through unchanged so error reporting keeps
  * working; keep secrets out of error messages at the throwing site.
@@ -53,8 +189,9 @@ export function redactionRule<T>(key: ServiceKey<T>, properties?: Extract<keyof
  * const listener = new RedactingEventListener(
  *   new OTELEventListener({ captureArguments: true, captureResults: true }),
  *   [
- *     { key: SecretClientKey }, // whole service is sensitive
- *     { key: VaultKey, properties: ['getSecret'] }, // only these calls
+ *     redactionRule(SecretClientKey).redactAll().build(), // whole service is sensitive
+ *     redactionRule(VaultKey).redact('getSecret').build(), // only this call
+ *     redactionRule(HealthKey).redactAll().exclude('ping').build(), // everything but this call
  *   ],
  * );
  * ```
@@ -66,13 +203,8 @@ export class RedactingEventListener implements ServiceModuleListener {
   ) {}
 
   onInitialize(context: InitializeContext): EventSpan | void {
-    // The initialize result is the service instance itself, so it is
-    // redacted only when the whole service is sensitive — a rule without
-    // `properties`.
-    return redactSpan(
-      this.delegate.onInitialize?.(context),
-      this.isRedacted(context.key),
-    );
+    const rule = this.rules.find((r) => r.key === context.key);
+    return redactSpan(this.delegate.onInitialize?.(context), rule);
   }
 
   onDispose(context: DisposeContext): EventSpan | void {
@@ -81,42 +213,31 @@ export class RedactingEventListener implements ServiceModuleListener {
   }
 
   onMethodCall(context: MethodCallContext): EventSpan | void {
-    const redacted = this.isRedacted(context.key, context.functionName);
+    const rule = this.rules.find((r) => r.key === context.key);
     const span = this.delegate.onMethodCall?.(
-      redacted
-        ? // Replace each argument rather than the whole array, so the
-          // delegate still sees the call's arity.
-          { ...context, args: context.args.map(() => REDACTED_VALUE) }
+      rule
+        ? {
+            ...context,
+            args: rule.maskArgs(context.functionName, context.args),
+          }
         : context,
     );
-    return redactSpan(span, redacted);
-  }
-
-  // 1. Si expiro el dbr `EXPIRED` el cron debe mandar a `FACE_MISMATCH`?
-  // 2. Si hubo un matchLevel intermediario el cron debe mandar a `FACE_MISMATCH`? (Probablemente no)
-  private isRedacted(key: ServiceKey<any>, propertyName?: string): boolean {
-    return this.rules.some(
-      (rule) =>
-        rule.key === key &&
-        // A rule without `properties` redacts everything on the key,
-        // including initialize — where no property name is passed —
-        // while a rule with `properties` matches only those calls.
-        (rule.properties === undefined ||
-          (propertyName !== undefined &&
-            rule.properties?.includes(propertyName))),
-    );
+    return redactSpan(span, rule, context.functionName);
   }
 }
 
 /**
  * Wraps the delegate's EventSpan so success values are redacted before
- * `end` sees them. `run` (and any future fields) pass through untouched.
+ * `end` sees them, by delegating to the rule's `maskResult`. `run` (and
+ * any future fields) pass through untouched. `functionName` is omitted
+ * for the initialize result (the instance itself).
  */
 function redactSpan(
   span: EventSpan | void,
-  redacted: boolean,
+  rule: RedactionRule<any> | undefined,
+  functionName?: string,
 ): EventSpan | void {
-  if (!redacted || !span?.end) {
+  if (!rule || !span?.end) {
     return span;
   }
   const end = span.end.bind(span);
@@ -125,7 +246,10 @@ function redactSpan(
     end: (outcome: EventOutcome) =>
       end(
         outcome.type === 'success'
-          ? { type: 'success', value: REDACTED_VALUE }
+          ? {
+              type: 'success',
+              value: rule.maskResult(functionName, outcome.value),
+            }
           : outcome,
       ),
   };