@effected/github 0.25.1 → 0.26.0

package/DeploymentEnvironment.js

@@ -1,3 +1,4 @@
+import { ENVIRONMENT_PUT_ROUTE_PARAMS, reservedBodyKey } from "./internal/requestOptions.js";
 import { unstubbed } from "./internal/unstubbed.js";
 import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
@@ -54,11 +55,15 @@ const make = (client) => {
 				repo,
 				environment: name
 			});
+			for (const key of Object.keys(config)) {
+				const reason = reservedBodyKey(key, ENVIRONMENT_PUT_ROUTE_PARAMS, "an environment setting");
+				if (reason !== void 0) return yield* Effect.die(/* @__PURE__ */ new RangeError(`DeploymentEnvironment.upsert: "${key}" ${reason}`));
+			}
 			yield* client.request("PUT /repos/{owner}/{repo}/environments/{environment_name}", {
-				...config,
 				owner,
 				repo,
-				environment_name: name
+				environment_name: name,
+				data: { ...config }
 			});
 		}),
 		list: Effect.fn("DeploymentEnvironment.list")(function* () {

package/GitHubApp.js

@@ -1,5 +1,6 @@
 import { GitHubError } from "./GitHubError.js";
 import { GitHubGraphQLError } from "./GraphQL.js";
+import { uploadChannelOf, withUploadChannel } from "./internal/uploads.js";
 import { unstubbed } from "./internal/unstubbed.js";
 import { GitHubClient, makeClientShape, resolveApiVersion } from "./GitHubClient.js";
 import { numericId } from "./internal/ids.js";
@@ -673,7 +674,11 @@ const makeRotatingClient = (mint, release, options, operation) => Effect.gen(fun
 		errors: [],
 		cause: error
 	}))));
-	return {
+	const upload = (route, params, schema) => Effect.flatMap(current, (client) => {
+		const channel = uploadChannelOf(client);
+		return channel === void 0 ? Effect.die(/* @__PURE__ */ new Error(`${operation}: the inner client carries no upload channel`)) : channel.upload(route, params, schema);
+	});
+	const shape = {
 		request: (route, params) => Effect.flatMap(current, (client) => client.request(route, params)),
 		requestDecoded: (route, params, schema) => Effect.flatMap(current, (client) => client.requestDecoded(route, params, schema)),
 		paginate: (route, params, pageOptions) => Effect.flatMap(current, (client) => client.paginate(route, params, pageOptions)),
@@ -682,6 +687,10 @@ const makeRotatingClient = (mint, release, options, operation) => Effect.gen(fun
 		rateLimit: Effect.flatMap(Ref.get(held), (state) => Option.isSome(state) ? state.value.client.rateLimit : Effect.succeed(Option.none())),
 		apiVersion
 	};
+	return withUploadChannel(shape, {
+		baseUrl: options.baseUrl,
+		upload
+	});
 });
 
 export { AppIdentity, BotIdentity, BotUser, GitHubApp, GitHubAppError, Installation, InstallationToken };

package/GitHubClient.js

@@ -1,7 +1,9 @@
 import { GitHubError } from "./GitHubError.js";
 import { GitHubGraphQLError } from "./GraphQL.js";
+import { DOTCOM_API_BASE_URL, originOf, uploadsBaseUrlFor, withUploadChannel } from "./internal/uploads.js";
+import { rawRequestRefusal, refusedRequest } from "./internal/confinement.js";
 import { RetryPolicy } from "./Resilience.js";
-import { DEFAULT_API_VERSION, makeTransport } from "./internal/octokit.js";
+import { DEFAULT_API_VERSION, expandOnDotcom, makeTransport } from "./internal/octokit.js";
 import { fromArray, paginate } from "./internal/paginate.js";
 import { unstubbed } from "./internal/unstubbed.js";
 import { Clock, Config, Context, Effect, Layer, Option, Schema, Stream } from "effect";
@@ -82,6 +84,34 @@ var GitHubFixtures = class {
 const resolvePolicy = (retry) => retry === void 0 ? RetryPolicy.default : retry === "off" ? RetryPolicy.none : retry;
 const perPageOf = (options) => options?.perPage ?? DEFAULT_PER_PAGE;
 const dies = unstubbed("GitHubClient.makeTest", "pass an override, or use GitHubClient.layerFixture for recorded responses.");
+const DOTCOM_API_ORIGIN = originOf(DOTCOM_API_BASE_URL);
+const doubleRefusal = (route, params) => rawRequestRefusal(expandOnDotcom, route, typeof params === "object" && params !== null ? params : {}, DOTCOM_API_ORIGIN);
+/**
+* `shape` with the live client's token-confinement refusals applied in front of
+* its four raw members, so a suite on a double sees the `rejected` failure
+* production would raise. A refused call never reaches the double's handler,
+* stub, fixture or `requested` log, as a refused live call never reaches the
+* wire.
+*/
+const confineDouble = (shape) => ({
+	...shape,
+	request: (route, params) => Effect.suspend(() => {
+		const reason = doubleRefusal(route, params);
+		return reason !== void 0 ? Effect.fail(refusedRequest(route, reason)) : shape.request(route, params);
+	}),
+	requestDecoded: (route, params, schema) => Effect.suspend(() => {
+		const reason = doubleRefusal(route, params);
+		return reason !== void 0 ? Effect.fail(refusedRequest(route, reason)) : shape.requestDecoded(route, params, schema);
+	}),
+	paginate: (route, params, options) => Effect.suspend(() => {
+		const reason = doubleRefusal(route, params);
+		return reason !== void 0 ? Effect.fail(refusedRequest(route, reason)) : shape.paginate(route, params, options);
+	}),
+	paginateStream: (route, params, options) => Stream.suspend(() => {
+		const reason = doubleRefusal(route, params);
+		return reason !== void 0 ? Stream.fail(refusedRequest(route, reason)) : shape.paginateStream(route, params, options);
+	})
+});
 /**
 * The typed GitHub API client.
 *
@@ -157,10 +187,16 @@ var GitHubClient = class GitHubClient extends Context.Service()("@effected/githu
 	* `rateLimit` answers `Option.none()` and `apiVersion` the live default,
 	* because a real client legitimately answers both without a request.
 	*
+	* It refuses what the live client refuses, before any override runs: a
+	* `baseUrl`, `url`, `request` or `method` parameter (a body field called
+	* `url` goes inside `data`), or a route that resolves off github.com's REST
+	* root, fails `kind: "rejected"` with no status. A double has no
+	* configured base, so an absolute-URL route must name `api.github.com`.
+	*
 	* For recorded responses that page for real, use
 	* {@link GitHubClient.layerFixture}.
 	*/
-	static makeTest = (overrides = {}) => ({
+	static makeTest = (overrides = {}) => confineDouble({
 		request: overrides.request ?? (() => dies("request")),
 		requestDecoded: overrides.requestDecoded ?? (() => dies("requestDecoded")),
 		paginate: overrides.paginate ?? (() => dies("paginate")),
@@ -189,8 +225,13 @@ var GitHubClient = class GitHubClient extends Context.Service()("@effected/githu
 	* one fixture both records the calls and classifies a raw failure the way
 	* the live client would; there is no need to classify by hand inside a
 	* {@link GitHubClient.layerTest} handler.
+	*
+	* It refuses what the live client refuses, exactly as
+	* {@link GitHubClient.makeTest} does. A refused call fails
+	* `kind: "rejected"` and is **not** recorded in `requested`: it is never
+	* served, as a refused live call never reaches the wire.
 	*/
-	static layerFixture = (fixtures) => Layer.succeed(GitHubClient, makeFixture(fixtures));
+	static layerFixture = (fixtures) => Layer.succeed(GitHubClient, confineDouble(makeFixture(fixtures)));
 };
 /** A calendar api-version: `YYYY-MM-DD`. */
 const API_VERSION_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
@@ -231,35 +272,43 @@ const makeClientShape = (options) => Effect.gen(function* () {
 		yield* Effect.annotateCurrentSpan({ route });
 		return (yield* transport.request(route, route, params)).data;
 	});
+	const decodeWith = (route, schema) => (data) => Schema.decodeUnknownEffect(schema)(data).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(GitHubError.decode(route, "response did not match its schema", error))));
 	const requestDecoded = Effect.fn("GitHubClient.requestDecoded")(function* (route, params, schema) {
 		yield* Effect.annotateCurrentSpan({ route });
 		const response = yield* transport.request(route, route, params);
-		return yield* Schema.decodeUnknownEffect(schema)(response.data).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(GitHubError.decode(route, "response did not match its schema", error))));
+		return yield* decodeWith(route, schema)(response.data);
 	});
+	const uploadsBaseUrl = uploadsBaseUrlFor(options.baseUrl);
+	const upload = (route, params, schema) => Effect.flatMap(transport.requestAt(route, route, params, uploadsBaseUrl), (response) => decodeWith(route, schema)(response.data));
 	const paginateStream = (route, params, options) => paginate(() => transport.pageSource(route, route, {
 		per_page: perPageOf(options),
 		...params
 	}), options?.maxPages);
-	return {
+	const paginateAll = Effect.fn("GitHubClient.paginate")(function* (route, params, options) {
+		yield* Effect.annotateCurrentSpan({
+			route,
+			perPage: perPageOf(options),
+			maxPages: options?.maxPages ?? -1
+		});
+		return yield* Stream.runCollect(paginateStream(route, params, options));
+	});
+	const graphql = Effect.fn("GitHubClient.graphql")(function* (document, variables) {
+		yield* Effect.annotateCurrentSpan({ document: document.name });
+		const raw = yield* transport.graphql(document.name, document.document, document.encodeVariables(variables));
+		return yield* document.decode(raw).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(GitHubGraphQLError.decode(document.name, "response did not match its schema", error))));
+	});
+	return withUploadChannel({
 		request,
 		requestDecoded,
-		paginate: Effect.fn("GitHubClient.paginate")(function* (route, params, options) {
-			yield* Effect.annotateCurrentSpan({
-				route,
-				perPage: perPageOf(options),
-				maxPages: options?.maxPages ?? -1
-			});
-			return yield* Stream.runCollect(paginateStream(route, params, options));
-		}),
+		paginate: paginateAll,
 		paginateStream,
-		graphql: Effect.fn("GitHubClient.graphql")(function* (document, variables) {
-			yield* Effect.annotateCurrentSpan({ document: document.name });
-			const raw = yield* transport.graphql(document.name, document.document, document.encodeVariables(variables));
-			return yield* document.decode(raw).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(GitHubGraphQLError.decode(document.name, "response did not match its schema", error))));
-		}),
+		graphql,
 		rateLimit: transport.rateLimit,
 		apiVersion
-	};
+	}, {
+		baseUrl: options.baseUrl,
+		upload
+	});
 });
 const makeFixture = (fixtures) => {
 	const requested = fixtures.requested;

package/GitHubError.js

@@ -1,4 +1,5 @@
 import { headerNumber, retryAfterMillisFrom } from "./internal/headers.js";
+import { scrubThrowable } from "./internal/scrub.js";
 import { Schema } from "effect";
 
 // src/GitHubError.ts
@@ -106,7 +107,7 @@ var GitHubError = class GitHubError extends Schema.TaggedError()("GitHubError",
 	* 422s ("Update is not a fast forward") are prose only.
 	*/
 	validation: Schema.optionalKey(Schema.Array(GitHubValidationEntry)),
-	/** The underlying throwable, when one exists. */
+	/** The underlying throwable, when one exists; an octokit throwable is kept as a credential-free copy. */
 	cause: Schema.optionalKey(Schema.Defect())
 }) {
 	/** `"GitBranch.upsert failed (422): Reference already exists"`. */
@@ -173,9 +174,19 @@ var GitHubError = class GitHubError extends Schema.TaggedError()("GitHubError",
 	* epoch second, and turning it into a delay needs a "now" the caller controls.
 	* The client supplies `Clock.currentTimeMillis`, which is the `TestClock`
 	* under test.
+	*
+	* The kept `cause` is a credential-free copy of the throwable, not the
+	* throwable itself. octokit redacts only the `authorization` credential and
+	* two query values; the copy also drops the request body (a webhook secret,
+	* GraphQL variables), the per-request options and the response body beyond
+	* its top-level `message` and `documentation_url`, drops `set-cookie`, and
+	* reads `REDACTED` for every other credential-bearing header. It keeps the
+	* prototype (so `instanceof` still answers), `name`, `message`, `status`,
+	* the method, the redacted url and the remaining headers. A throwable with
+	* no `request`, `response` or `headers` field is kept as it is.
 	*/
 	static fromOctokit(operation, error, nowMillis) {
-		return fromFacts(operation, readThrowable(error), nowMillis, error);
+		return fromFacts(operation, readThrowable(error), nowMillis, scrubThrowable(error));
 	}
 	/**
 	* Classify a raw HTTP response: a status, its headers and its JSON body.

package/GitHubRelease.js

@@ -1,4 +1,5 @@
 import { GitHubError } from "./GitHubError.js";
+import { originOf, uploadChannelOf, uploadsBaseUrlFor } from "./internal/uploads.js";
 import { unstubbed } from "./internal/unstubbed.js";
 import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
@@ -19,7 +20,15 @@ var ReleaseInfo = class extends Schema.Class("ReleaseInfo")({
 	prerelease: Schema.Boolean,
 	/** The web URL. */
 	url: Schema.String,
-	/** The templated upload endpoint GitHub hands back for assets. */
+	/**
+	* The templated upload endpoint GitHub hands back for assets.
+	*
+	* @remarks
+	* {@link GitHubReleaseShape.uploadAsset} never routes by this value: it is
+	* response data. It only cross-checks that its origin is the upload host
+	* derived from the client's configured base URL, and refuses the upload
+	* when it is not.
+	*/
 	uploadUrl: Schema.String
 }) {};
 /**
@@ -172,16 +181,26 @@ const make = (client) => {
 				release: release.id,
 				asset: asset.name
 			});
-			const raw = yield* client.requestDecoded(asset.label === void 0 ? "POST /repos/{owner}/{repo}/releases/{release_id}/assets{?name}" : "POST /repos/{owner}/{repo}/releases/{release_id}/assets{?name,label}", {
+			const channel = uploadChannelOf(client);
+			const uploadsBaseUrl = uploadsBaseUrlFor(channel?.baseUrl);
+			const expected = originOf(uploadsBaseUrl);
+			const offered = originOf(release.uploadUrl);
+			if (expected === void 0 || offered !== expected) return yield* Effect.fail(new GitHubError({
+				kind: "rejected",
+				operation: "GitHubRelease.uploadAsset",
+				reason: offered === void 0 ? `release ${release.id} has no absolute upload URL; refusing to upload` : `release ${release.id}'s upload URL is on ${offered}, not this client's upload host ${expected ?? uploadsBaseUrl}; refusing to send the token there`
+			}));
+			const route = asset.label === void 0 ? "POST /repos/{owner}/{repo}/releases/{release_id}/assets{?name}" : "POST /repos/{owner}/{repo}/releases/{release_id}/assets{?name,label}";
+			const params = {
 				owner,
 				repo,
 				release_id: release.id,
 				name: asset.name,
 				...asset.label === void 0 ? {} : { label: asset.label },
 				data: asset.data,
-				baseUrl: UPLOADS_BASE_URL,
 				headers: { "content-type": asset.contentType }
-			}, AssetResponse);
+			};
+			const raw = channel === void 0 ? yield* client.requestDecoded(route, params, AssetResponse) : yield* channel.upload(route, params, AssetResponse);
 			return assetOf(raw);
 		}),
 		listAssets: Effect.fn("GitHubRelease.listAssets")(function* (id, options) {
@@ -199,7 +218,5 @@ const make = (client) => {
 		})
 	};
 };
-/** Release assets do not go to the API host. */
-const UPLOADS_BASE_URL = "https://uploads.github.com";
 
 export { GitHubRelease, ReleaseAsset, ReleaseInfo };

package/GitHubRepository.js

@@ -1,4 +1,5 @@
 import { GraphQLDocument } from "./GraphQL.js";
+import { reservedSettingKey } from "./internal/requestOptions.js";
 import { unstubbed, unstubbedRead } from "./internal/unstubbed.js";
 import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
@@ -8,7 +9,7 @@ import { Context, Effect, Layer, Schema } from "effect";
 // src/GitHubRepository.ts
 /**
 * A {@link RepositoryPatch} from a draft, dropping every explicitly-`undefined`
-* field.
+* field, plus any settings octokit's types do not know yet.
 *
 * @remarks
 * The supported spelling for "apply only what was configured" — the natural
@@ -18,6 +19,13 @@ import { Context, Effect, Layer, Schema } from "effect";
 * `PATCH` treats an absent field as "leave it alone", while an explicit `null`
 * or `undefined` is a value.
 *
+* `options.extra` is the typed escape hatch for a setting GitHub accepts
+* before octokit's generated types declare it: the draft stays checked, and
+* only the extras ride unchecked. The result is still typed `RepositoryPatch`,
+* and `GitHubRepository.updateSettings` sends every key it carries. A known key
+* passed through `extra` throws a `RangeError` rather than skipping the draft's
+* type check (see {@link RepositoryPatchOptions.extra}).
+*
 * A key-by-key loop still defeats TypeScript's correlation between two indexed
 * accesses (`draft[key] = source[key]` over a union `key`), which no helper can
 * fix — build the draft as a literal where you can.
@@ -27,23 +35,60 @@ import { Context, Effect, Layer, Schema } from "effect";
 * import { repositoryPatch } from "@effected/github";
 *
 * // `config.has_issues` is `boolean | undefined`; absent fields drop out.
-* const patch = repositoryPatch({
-*   has_issues: config.has_issues,
-*   has_wiki: config.has_wiki,
-*   description: config.description,
-* });
+* const patch = repositoryPatch(
+*   {
+*     has_issues: config.has_issues,
+*     has_wiki: config.has_wiki,
+*     description: config.description,
+*   },
+*   // A setting GitHub accepts before octokit's types declare it.
+*   { extra: { has_new_feature: true } },
+* );
 * ```
 *
 * @param draft - The fields to apply, any of which may be `undefined`.
+* @param options - `extra`: settings the generated type does not declare.
 * @returns A patch carrying only the fields that were actually set.
 *
 * @public
 */
-const repositoryPatch = (draft) => {
+const repositoryPatch = (draft, options) => {
 	const out = {};
-	for (const [key, value] of Object.entries(draft)) if (value !== void 0) out[key] = value;
+	for (const [key, value] of Object.entries(draft)) {
+		refuseReserved(key);
+		if (value !== void 0) out[key] = value;
+	}
+	for (const [key, value] of Object.entries(options?.extra ?? {})) {
+		refuseReserved(key);
+		if (Object.hasOwn(GRAPHQL_ONLY_SETTINGS, key)) throw new RangeError(`repositoryPatch: "${key}" can only be set through GraphQL; use GitHubRepository.applySettings, not a REST patch`);
+		if (REPOSITORY_REST_SETTING_KEYS.has(key)) throw new RangeError(`repositoryPatch: "${key}" is a declared repository setting; pass it in the draft, where its type is checked, not in extra`);
+		if (value !== void 0) out[key] = value;
+	}
 	return out;
 };
+/** A `RangeError` for a key octokit would read as something other than a setting. */
+const refuseReserved = (key) => {
+	const reason = reservedSettingKey(key);
+	if (reason !== void 0) throw new RangeError(`repositoryPatch: "${key}" ${reason}; it is never sent`);
+};
+/**
+* The parameters of a repository PATCH, with the settings as octokit's `data`.
+*
+* @remarks
+* `data` is octokit's explicit body: `@octokit/endpoint` sends it verbatim and
+* reads no key inside it as a request option or a path parameter. Spreading
+* the settings beside `owner` and `repo` instead lets an open map choose the
+* request's host, headers, fetch implementation or path, which is how an
+* authenticated PATCH reaches another host with the token attached. So the
+* confinement holds by construction; the reserved-name refusals are defence in
+* depth. The generated parameter type has no `data`, so the cast is here, on
+* the one shape both write paths send.
+*/
+const patchParams = (owner, repo, body) => ({
+	owner,
+	repo,
+	data: body
+});
 /**
 * Fields in the user-facing `security_and_analysis` block that GitHub accepts
 * as `{ status: "enabled" | "disabled" }`.
@@ -268,26 +313,29 @@ const make = (client) => {
 				repo,
 				fields: Object.keys(patch).length
 			});
-			return yield* client.request("PATCH /repos/{owner}/{repo}", {
-				...preparePatch(patch),
-				owner,
-				repo
-			});
+			return yield* client.request("PATCH /repos/{owner}/{repo}", patchParams(owner, repo, preparePatch(patch)));
 		}),
 		defaultBranch: Effect.map(settings, (repository) => repository.default_branch),
 		nodeId: Effect.map(settings, (repository) => repository.node_id),
 		ownerType,
-		applySettings: Effect.fn("GitHubRepository.applySettings")(function* (input) {
+		applySettings: Effect.fn("GitHubRepository.applySettings")(function* (input, options) {
 			const { owner, repo } = yield* Repo;
+			const sendUnknown = options?.unknownKeys === "send";
 			yield* Effect.annotateCurrentSpan({
 				owner,
-				repo
+				repo,
+				unknownKeys: sendUnknown ? "send" : "ignore"
 			});
 			const rest = {};
 			const graphql = {};
 			const graphqlKeys = [];
 			const ignored = [];
+			const unverified = [];
 			for (const [key, value] of Object.entries(input)) {
+				if (reservedSettingKey(key) !== void 0) {
+					ignored.push(key);
+					continue;
+				}
 				const graphqlField = Object.hasOwn(GRAPHQL_ONLY_SETTINGS, key) ? GRAPHQL_ONLY_SETTINGS[key] : void 0;
 				if (graphqlField !== void 0) {
 					graphql[graphqlField] = value;
@@ -295,19 +343,22 @@ const make = (client) => {
 					continue;
 				}
 				const removedIn = Object.hasOwn(REMOVED_BY_PINNED_VERSION, key) ? REMOVED_BY_PINNED_VERSION[key] : void 0;
-				if (!REPOSITORY_REST_SETTING_KEYS.has(key) || removedIn !== void 0 && client.apiVersion >= removedIn) {
+				if (removedIn !== void 0 && client.apiVersion >= removedIn) {
 					ignored.push(key);
 					continue;
 				}
+				if (!REPOSITORY_REST_SETTING_KEYS.has(key)) {
+					if (!sendUnknown) {
+						ignored.push(key);
+						continue;
+					}
+					unverified.push(key);
+				}
 				rest[key] = value;
 			}
 			const prepared = preparePatch(rest);
 			const restKeys = Object.keys(prepared);
-			if (restKeys.length > 0) yield* client.request("PATCH /repos/{owner}/{repo}", {
-				...prepared,
-				owner,
-				repo
-			});
+			if (restKeys.length > 0) yield* client.request("PATCH /repos/{owner}/{repo}", patchParams(owner, repo, prepared));
 			if (Object.keys(graphql).length > 0) {
 				const repository = yield* client.request("GET /repos/{owner}/{repo}", {
 					owner,
@@ -321,7 +372,8 @@ const make = (client) => {
 			return {
 				rest: restKeys,
 				graphql: graphqlKeys,
-				ignored
+				ignored,
+				unverified: unverified.filter((key) => Object.hasOwn(prepared, key))
 			};
 		})
 	};

package/GraphQL.js

@@ -1,4 +1,5 @@
 import { retryAfterMillisFrom } from "./internal/headers.js";
+import { scrubThrowable } from "./internal/scrub.js";
 import { Schema } from "effect";
 
 // src/GraphQL.ts
@@ -78,6 +79,11 @@ var GitHubGraphQLError = class GitHubGraphQLError extends Schema.TaggedError()("
 	* failure with a `status`. Both arrive as throwables and both are read
 	* structurally, for the same reason the REST classifier does it — the error
 	* classes live in packages this one does not declare.
+	*
+	* The kept `cause` is the same credential-free copy
+	* {@link GitHubError.fromOctokit} keeps: the GraphQL document, its variables
+	* and any partial `data` are dropped with the rest of the request and response
+	* bodies.
 	*/
 	static fromThrowable(operation, error, nowMillis) {
 		const record = typeof error === "object" && error !== null ? error : void 0;
@@ -92,7 +98,7 @@ var GitHubGraphQLError = class GitHubGraphQLError extends Schema.TaggedError()("
 			reason,
 			errors: entries,
 			...retryAfterMillis !== void 0 ? { retryAfterMillis } : {},
-			cause: error
+			cause: scrubThrowable(error)
 		});
 	}
 };