@fabrika/proxy-core 0.9.0-dev.1 → 0.9.0-dev.3

package/types/src/log.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Logging, constrained so that secret material cannot reach it.
+ *
+ * The rule is structural rather than aspirational: a log field is a `string | number | boolean |
+ * null`, call sites pass only decision metadata, and the two values that CAN carry a credential —
+ * a request path (share-link tokens ride in the path) and a URL — go through `redactPath` /
+ * `redactUrl` first. Nothing in this package ever passes a header, a cookie, a token or a caught
+ * error object to a logger.
+ */
+export type LogValue = string | number | boolean | null;
+export type LogFields = Record<string, LogValue>;
+export interface ProxyLogger {
+    info(message: string, fields?: LogFields): void;
+    warn(message: string, fields?: LogFields): void;
+    error(message: string, fields?: LogFields): void;
+}
+/** Emits one JSON object per line — what Zerops' log collector expects. */
+export declare const consoleLogger: ProxyLogger;
+/** A logger that discards everything — the default, so a library consumer opts IN to output. */
+export declare const silentLogger: ProxyLogger;
+/**
+ * Make a path safe to log. Two hazards, both real:
+ *   - a query string can carry a declared `query` credential (`?pxt=<token>`) — dropped entirely;
+ *   - a path SEGMENT can be a share-link `px_` credential — replaced with `px_***`.
+ * Anything else is preserved, because an unloggable path is an undebuggable proxy.
+ */
+export declare function redactPath(pathname: string): string;
+/** Origin + redacted path. Never the query string. */
+export declare function redactUrl(url: URL): string;