@didit-protocol/sdk-node 2.13.0 → 2.13.1

package/dist/index.d.cts

@@ -23764,7 +23764,7 @@ declare class TokenVerificationError extends DiditError {
     constructor(reason: TokenVerificationReason, message: string);
 }
 
-declare const VERSION = "2.13.0";
+declare const VERSION = "2.13.1";
 
 /**
  * The canonical JSON of a parsed webhook body: the text `X-Signature-V2` signs

package/dist/index.d.ts

@@ -23764,7 +23764,7 @@ declare class TokenVerificationError extends DiditError {
     constructor(reason: TokenVerificationReason, message: string);
 }
 
-declare const VERSION = "2.13.0";
+declare const VERSION = "2.13.1";
 
 /**
  * The canonical JSON of a parsed webhook body: the text `X-Signature-V2` signs

package/dist/index.js

@@ -188,6 +188,52 @@ function makeStatusError(status, body, headers, secrets = []) {
   const ErrorClass = STATUS_ERRORS[status] ?? (status >= 500 ? InternalServerError : APIStatusError);
   return new ErrorClass(message, status, cleanBody, redactHeaders(headers, secrets));
 }
+var REDACTED = "[redacted]";
+function redactStructured(value, secrets) {
+  const active = secrets.filter((s) => s.length > 0);
+  const text = (input) => active.some((secret) => input.includes(secret)) ? REDACTED : input;
+  const scrub = (input) => {
+    if (typeof input === "string") return text(input);
+    if (Array.isArray(input)) return input.map(scrub);
+    if (isRecord(input)) {
+      const out = /* @__PURE__ */ new Map();
+      const taken = new Set(Object.keys(input).filter((key) => text(key) === key));
+      let next = 1;
+      for (const [key, item] of Object.entries(input)) {
+        let name = key;
+        if (text(key) !== key) {
+          do {
+            name = next === 1 ? REDACTED : `${REDACTED}${next}`;
+            next++;
+          } while (taken.has(name));
+          taken.add(name);
+        }
+        out.set(name, scrub(item));
+      }
+      return Object.fromEntries(out);
+    }
+    return input;
+  };
+  return scrub(value);
+}
+function sanitizeResponse(headers, text, secrets) {
+  const clean = new Headers();
+  headers.forEach((value, name) => {
+    const folded = name.toLowerCase();
+    if (!secrets.some((secret) => secret && folded.includes(secret.toLowerCase()))) {
+      clean.append(name, redactStructured(value, secrets));
+    }
+  });
+  let body = REDACTED;
+  if (text) {
+    try {
+      body = JSON.stringify(redactStructured(JSON.parse(text), secrets));
+    } catch {
+      body = REDACTED;
+    }
+  }
+  return { headers: clean, text: body };
+}
 
 // src/core/api-promise.ts
 var APIPromise = class extends Promise {
@@ -278,7 +324,7 @@ function decodeDates(value, plan, named, depth = 0) {
 }
 
 // src/core/version.ts
-var VERSION = "2.13.0";
+var VERSION = "2.13.1";
 
 // src/core/runtime.ts
 function processLike() {
@@ -11171,11 +11217,15 @@ async function send(transport, request) {
       log(null, null, "timeout");
       return new APITimeoutError(
         `The issuer did not answer ${method} ${path} within ${transport.timeout} ms.`,
-        { cause }
+        // A request that carries secrets keeps no cause: a transport may quote the serialized body in it.
+        request.structuredRedaction ? void 0 : { cause }
       );
     }
     log(null, null, "connection_error");
-    return new APIConnectionError(`Could not reach the issuer for ${method} ${path}.`, { cause });
+    return new APIConnectionError(
+      `Could not reach the issuer for ${method} ${path}.`,
+      request.structuredRedaction ? void 0 : { cause }
+    );
   };
   let status;
   let responseHeaders;
@@ -11203,19 +11253,28 @@ async function send(transport, request) {
   } finally {
     clearTimeout(timer);
   }
-  log(status, responseHeaders);
+  const secrets = request.secrets ?? [];
+  const sanitized = request.structuredRedaction ? sanitizeResponse(responseHeaders, text, secrets) : null;
+  const errorHeaders = sanitized?.headers ?? responseHeaders;
+  log(status, errorHeaders);
   if (status < 200 || status > 299) {
-    throw makeStatusError(status, bodyOf(text), responseHeaders, request.secrets ?? []);
+    throw makeStatusError(
+      status,
+      bodyOf(sanitized?.text ?? text),
+      errorHeaders,
+      sanitized ? [] : secrets
+    );
   }
-  if (status === 204 || !text) return { status, headers: responseHeaders, data: null };
+  if (status === 204 || !text)
+    return { status, headers: responseHeaders, errorHeaders, data: null };
   try {
-    return { status, headers: responseHeaders, data: JSON.parse(text) };
+    return { status, headers: responseHeaders, errorHeaders, data: JSON.parse(text) };
   } catch {
-    const type = responseHeaders.get("content-type") ?? "no content type";
+    const type = errorHeaders.get("content-type") ?? "no content type";
     throw new APIResponseValidationError(
       `Expected a JSON response from ${method} ${path}, got ${type}.`,
       status,
-      responseHeaders
+      errorHeaders
     );
   }
 }
@@ -11320,10 +11379,16 @@ function textList(value, name) {
   }
   return [...value];
 }
+var MIN_SECRET_LENGTH = 16;
 function assertionSecrets(value) {
-  if (typeof value === "string") return value.length > 0 ? [value] : [];
+  if (typeof value === "string") return value.length >= MIN_SECRET_LENGTH ? [value] : [];
   if (Array.isArray(value)) return value.flatMap(assertionSecrets);
-  if (isRecord4(value)) return Object.values(value).flatMap(assertionSecrets);
+  if (isRecord4(value)) {
+    return Object.entries(value).flatMap(([key, item]) => [
+      ...assertionSecrets(key),
+      ...assertionSecrets(item)
+    ]);
+  }
   return [];
 }
 function optionalText(value, name) {
@@ -11603,7 +11668,6 @@ var Authentication = class _Authentication {
     if (assertion !== void 0 && assertion !== null) {
       if (!isRecord4(assertion)) throw new TypeError("assertion must be an object.");
       body.assertion = assertion;
-      secrets.push(...assertionSecrets(assertion));
     }
     const scopes = given.scopes;
     if (scopes !== void 0 && scopes !== null) body.scopes = textList(scopes, "scopes");
@@ -11618,7 +11682,19 @@ var Authentication = class _Authentication {
       }
       body.lifetime = lifetime;
     }
-    const call = { ...this.#bearerCall("POST", AGENT_CONSENT_PATH, token), json: body, secrets };
+    let sent;
+    try {
+      sent = JSON.parse(JSON.stringify(body));
+    } catch {
+      throw new TypeError("Could not encode the agent consent request.");
+    }
+    secrets.push(...assertionSecrets(sent.assertion));
+    const call = {
+      ...this.#bearerCall("POST", AGENT_CONSENT_PATH, token),
+      json: sent,
+      secrets,
+      structuredRedaction: true
+    };
     return await this.#object(call);
   }
   /**
@@ -11634,7 +11710,8 @@ var Authentication = class _Authentication {
     const call = {
       ...this.#bearerCall("POST", AGENT_CONSENT_PASSKEY_PATH, token),
       json: { challenge },
-      secrets: [token, challenge]
+      secrets: [token, challenge],
+      structuredRedaction: true
     };
     return await this.#object(call);
   }
@@ -11654,7 +11731,7 @@ var Authentication = class _Authentication {
       throw new APIResponseValidationError(
         `Expected a JSON object from ${call.method} ${pathOf(call.url)}.`,
         response.status,
-        response.headers
+        response.errorHeaders
       );
     }
     return response.data;