@farukada/aws-langgraph-dynamodb-ts 0.9.0 → 1.0.0-rc.2

package/dist/shared/logging/redaction.js

@@ -1,9 +1,44 @@
 "use strict";
+/**
+ * Hides how a logger and a value are redacted.
+ *
+ * A redacting logger walks every argument of every line, bounded in depth and
+ * safe against cycles and hostile getters, and replaces the value of any key
+ * that looks like a secret and any text that looks like one; the same walk
+ * serves `redactSecrets` for a value a caller wants to log themselves.
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.redactSecrets = redactSecrets;
 exports.redactLogger = redactLogger;
-const redaction_walk_1 = require("./redaction-walk");
+exports.walkObject = walkObject;
+const errors_1 = require("../errors/errors");
+const collaborators_1 = require("../validation/collaborators");
+const option_shape_1 = require("../validation/option-shape");
+const primitives_1 = require("../validation/primitives");
+const logger_1 = require("./logger");
 const secret_patterns_1 = require("./secret-patterns");
+/** Substituted for a log argument whose redaction itself failed (a throwing getter, say). */
+const UNREDACTABLE = '[UNREDACTABLE]';
+/**
+ * Reject a list of value shapes this package could not apply.
+ *
+ * Accepts: `value` — the list as the caller gave it. `field` — what the error
+ * names.
+ *
+ * Returns: nothing: the value is kept under its declared type, and this
+ * checks it. An empty list is valid, and is how a caller turns value matching
+ * off.
+ *
+ * Throws: `VALIDATION` naming `field` for a non-array or an entry that is
+ * not a `RegExp`. {@link redactText} skips such an entry, which protects
+ * nothing while the caller believes it does, so it is refused where it is
+ * supplied instead.
+ */
+function assertRegExpArray(value, field) {
+    if (!Array.isArray(value) || value.some((entry) => !(0, secret_patterns_1.isRegExp)(entry))) {
+        throw (0, errors_1.validationError)(`${field} must be an array of RegExp`, field);
+    }
+}
 /**
  * Recursively clone `value`, replacing any value at a secret-looking key with
  * `[REDACTED]` and any recognised secret *shape* inside a string — including an
@@ -17,44 +52,265 @@ const secret_patterns_1 = require("./secret-patterns");
  * `stack` redacted and every other own property recursed like a plain object.
  * `Date`/`RegExp` keep their identity rather than collapsing to `{}`,
  * `Set`/`Map` render as their contents, and binary views become a short label.
- * Does not mutate the input.
+ *
+ * Accepts: `value` — any log argument, including `undefined`, a primitive, a
+ * typed `Error`, a class instance or a `Record`, so callers never cast. A
+ * cyclic or shared graph is fine; each node is walked once. `patterns` and
+ * `valuePatterns` — the key names and value shapes to redact, an array of
+ * strings and an array of `RegExp` respectively; both default to this
+ * package's own lists, and an empty one turns that rule off.
+ *
+ * Returns: a redacted clone. The input is never mutated — a logger that
+ * scrubbed the caller's own object would corrupt the very data the application
+ * is working with.
+ *
+ * Throws: `VALIDATION` naming `patterns` or `valuePatterns` for a list this
+ * function could not apply, which is a mistake in the call itself and is
+ * raised before anything is walked. Nothing after that: a value whose
+ * redaction fails — a throwing getter, a structure deep enough to exhaust the
+ * stack — is replaced whole by `[UNREDACTABLE]`, since a logger that throws
+ * takes down the operation it was only observing. {@link redactLogger}
+ * redacts one argument per call, so there a single hostile argument is what is
+ * lost rather than the record around it.
  */
 function redactSecrets(value, patterns = secret_patterns_1.DEFAULT_SECRET_KEY_PATTERNS, valuePatterns = secret_patterns_1.DEFAULT_SECRET_VALUE_PATTERNS) {
-    const seen = new WeakSet();
+    (0, primitives_1.assertStringArray)(patterns, 'patterns');
+    assertRegExpArray(valuePatterns, 'valuePatterns');
+    // `walking` detects a cycle; `done` memoises a finished node. Both are
+    // needed and they answer different questions. A guard that only removed a
+    // node when its subtree finished is correct for cycles but re-walks every
+    // node reachable by more than one path, so a graph that merely *shares*
+    // structure — not even a cycle — costs exponential time: without `done`, a
+    // few dozen shared objects in a sub-kilobyte argument would block the event
+    // loop for minutes, and this is a public export reachable from caller code.
+    const walking = new WeakSet();
+    const done = new WeakMap();
     const walk = (current) => {
         if (typeof current === 'string')
             return (0, secret_patterns_1.redactText)(current, valuePatterns);
         if (current === null || typeof current !== 'object')
             return current;
-        if (seen.has(current))
+        if (done.has(current))
+            return done.get(current);
+        if (walking.has(current))
             return '[Circular]';
-        seen.add(current);
+        walking.add(current);
         try {
-            return (0, redaction_walk_1.walkObject)(current, { keyPatterns: patterns, valuePatterns, walk });
+            const redacted = walkObject(current, { keyPatterns: patterns, valuePatterns, walk });
+            done.set(current, redacted);
+            return redacted;
         }
         finally {
-            seen.delete(current);
+            walking.delete(current);
         }
     };
-    return walk(value);
+    try {
+        return walk(value);
+    }
+    catch {
+        // Every failure of the walk yields the marker: a `RangeError` from nesting
+        // deeper than the stack holds, and equally a getter of the caller's own
+        // that throws. Telling the two apart served no caller. The value is being
+        // prepared for a log line, and the log line is typically written from a
+        // `catch`, so a throw here does not report the hostile value — it replaces
+        // the failure that was being reported with a `TypeError` about a getter.
+        return UNREDACTABLE;
+    }
 }
 /**
- * Wrap a logger so object args are redacted before delegation. The message
- * string is passed through unchanged (never interpolate secrets into it).
+ * Reject redaction options that would silently fail to redact.
+ *
+ * A non-string in `extraKeys` reached `key.toLowerCase()` and raised a bare
+ * `TypeError` at the first log call; a non-`RegExp` in `extraValuePatterns` is
+ * skipped by {@link redactText} and would have protected nothing while the
+ * caller believed it did. An `options` that is not an object at all carried no
+ * rule to begin with, and was read as "none given", leaving the caller running
+ * on a default it believed it had overridden. All three are refused here,
+ * once, where they are configured.
+ *
+ * Accepts: `options` — as the caller gave it.
+ *
+ * Returns: nothing: the value is kept under its declared type, and this
+ * checks it.
+ *
+ * Throws: `VALIDATION` naming `options`, `extraKeys` or `extraValuePatterns`.
+ */
+function assertRedactionOptions(options) {
+    (0, option_shape_1.assertObjectShape)(options, 'options');
+    if (options.extraKeys !== undefined)
+        (0, primitives_1.assertStringArray)(options.extraKeys, 'extraKeys');
+    if (options.extraValuePatterns !== undefined) {
+        assertRegExpArray(options.extraValuePatterns, 'extraValuePatterns');
+    }
+}
+/**
+ * Wrap a logger so object args are redacted before delegation.
+ *
+ * Accepts: `inner` — the logger to delegate to; it must carry all four
+ * methods, because a missing one is a wiring mistake worth naming here rather
+ * than at the first log line. `options.extraKeys` — further key names to
+ * redact, matched like the defaults. `options.extraValuePatterns` — further
+ * secret shapes; each must be a `RegExp`, and it is applied globally whether or
+ * not it carries the `g` flag.
+ *
+ * Returns: a logger with the same four methods.
+ *
+ * Throws: `VALIDATION` naming `logger` or `logger.<method>` for a logger it
+ * could not delegate to, and `options`, `extraKeys` or `extraValuePatterns`
+ * for an option of the wrong type. Nothing at log time.
+ *
+ * Guarantees: the message string is passed through unchanged — never
+ * interpolate a secret into it — and every other argument is redacted before
+ * it reaches `inner`. Past the wrap call nothing escapes a log call: an
+ * argument whose redaction fails is replaced by a fixed marker, and a failure
+ * of `inner` itself is absorbed, because the
+ * operation that wrote the line was only observing itself and is commonly
+ * reporting some other failure already.
  */
 function redactLogger(inner, options = {}) {
+    (0, collaborators_1.assertMembers)(inner, collaborators_1.LOGGER_MEMBERS, 'logger');
+    assertRedactionOptions(options);
     const patterns = options.extraKeys
-        ? [...secret_patterns_1.DEFAULT_SECRET_KEY_PATTERNS, ...options.extraKeys.map((key) => key.toLowerCase())]
+        ? [...secret_patterns_1.DEFAULT_SECRET_KEY_PATTERNS, ...options.extraKeys.map(secret_patterns_1.normaliseKey)]
         : secret_patterns_1.DEFAULT_SECRET_KEY_PATTERNS;
     const valuePatterns = options.extraValuePatterns
         ? [...secret_patterns_1.DEFAULT_SECRET_VALUE_PATTERNS, ...options.extraValuePatterns]
         : secret_patterns_1.DEFAULT_SECRET_VALUE_PATTERNS;
-    const wrap = (args) => args.map((arg) => redactSecrets(arg, patterns, valuePatterns));
+    const deliver = (method) => (message, ...args) => (0, logger_1.absorbLoggerFailure)(() => inner[method](message, ...args.map((arg) => redactSecrets(arg, patterns, valuePatterns))));
     return {
-        info: (message, ...args) => inner.info(message, ...wrap(args)),
-        warn: (message, ...args) => inner.warn(message, ...wrap(args)),
-        error: (message, ...args) => inner.error(message, ...wrap(args)),
-        debug: (message, ...args) => inner.debug(message, ...wrap(args)),
+        info: deliver('info'),
+        warn: deliver('warn'),
+        error: deliver('error'),
+        debug: deliver('debug'),
     };
 }
-//# sourceMappingURL=redaction.js.map
+/** True when `value` is a Set, tested by tag so a cross-realm Set still matches. */
+function isSetValue(value) {
+    return Object.prototype.toString.call(value) === '[object Set]';
+}
+/** True when `value` is a Map, tested by tag so a cross-realm Map still matches. */
+function isMapValue(value) {
+    return Object.prototype.toString.call(value) === '[object Map]';
+}
+/**
+ * True when `value` is an Error (or subclass) or a `DOMException` — which has
+ * its own tag yet carries the same `name`/`message`/`stack` — tested by tag,
+ * not `instanceof`, so a cross-realm error still matches.
+ */
+function isErrorValue(value) {
+    const tag = Object.prototype.toString.call(value);
+    return tag === '[object Error]' || tag === '[object DOMException]';
+}
+/**
+ * True for a value whose identity matters more than its own properties.
+ * `Date` and `RegExp` have none, so recursing either would yield a bare `{}`.
+ */
+function isOpaqueValue(value) {
+    const tag = Object.prototype.toString.call(value);
+    return tag === '[object Date]' || tag === '[object RegExp]';
+}
+/**
+ * Rebuild entries into a plain object, redacting values at secret-looking
+ * keys. Properties are defined, not assigned: `out['__proto__'] = …` would
+ * replace the result's prototype (and drop the entry) instead of recording the
+ * key as data.
+ */
+function redactEntries(entries, keyPatterns, walk) {
+    const out = {};
+    for (const [key, value] of entries) {
+        Object.defineProperty(out, key, {
+            value: (0, secret_patterns_1.isSecretKey)(key, keyPatterns) ? secret_patterns_1.REDACTED : walk(value),
+            enumerable: true,
+            writable: true,
+            configurable: true,
+        });
+    }
+    return out;
+}
+/**
+ * A Map's entries as an object. Keys are stringified so a non-string key is
+ * still reported rather than dropped — including as `[object Object]` for a
+ * plain-object key, which beats silently losing the entry — and each is
+ * checked against the secret-key patterns exactly as a plain object's own
+ * keys are.
+ *
+ * The annotation on `keyText` is `Redactable`'s own shape restated with an
+ * explicit `toString`, which every one of its members already has; it changes
+ * nothing about which key is what, only what `no-base-to-string` can see, so
+ * it stops mistaking the deliberate `[object Object]` case above for a bug.
+ */
+function redactMap(value, deps) {
+    const entries = [...value].map(([key, entry]) => {
+        const keyText = key;
+        return [String(keyText), entry];
+    });
+    return redactEntries(entries, deps.keyPatterns, deps.walk);
+}
+/**
+ * Rebuild an Error as a plain object carrying its redacted text alongside its
+ * redacted own properties. The one exception is an Error with no own
+ * enumerable data, no `cause`, no aggregated `errors`, and no secret in its
+ * text: it is returned by reference so its identity and stack trace survive,
+ * which is what keeps a caught error useful in a log.
+ *
+ * `cause` and `AggregateError.errors` are copied explicitly because both are
+ * defined *non-enumerable* per spec, so `Object.entries` never sees them.
+ * Without this the whole chain vanished on every rebuild — and the rebuild
+ * always fires for this library's own error types, since each attaches an
+ * enumerable `code`/`context`. A redacted `RETRY_EXHAUSTED` would then no
+ * longer say whether the underlying failure was a throttle, a validation error
+ * or a network fault, which is the entire reason it carries a cause. A bare
+ * Error *with* a cause is rebuilt for the same reason: passing it by reference
+ * would hand the caller whatever secret the cause carries. Recursing through
+ * `walk` redacts the chain too, and the cycle guard handles a cause that
+ * points back at its own wrapper.
+ */
+function redactError(current, entries, deps) {
+    const text = (0, secret_patterns_1.redactErrorText)(current, deps.valuePatterns);
+    const aggregated = current.errors;
+    const bare = entries.length === 0 && current.cause === undefined && aggregated === undefined;
+    if (bare && !text.changed)
+        return current;
+    const out = redactEntries(entries, deps.keyPatterns, deps.walk);
+    out.name = text.name;
+    out.message = text.message;
+    out.stack = text.stack;
+    if (current.cause !== undefined)
+        out.cause = deps.walk(current.cause);
+    if (Array.isArray(aggregated))
+        out.errors = deps.walk(aggregated);
+    return out;
+}
+/**
+ * Dispatch one non-null object by its shape.
+ *
+ * Accepts: `current` — any object. `deps.walk` — how to recurse, which carries
+ * the cycle and memo state this module deliberately does not own.
+ *
+ * Returns: the redacted form — arrays and plain objects recursed, binary views
+ * collapsed to a label, `Date`/`RegExp` passed through by reference so they do
+ * not become `{}`, `Set`/`Map` rendered as their contents, and an Error through
+ * the error path, which preserves the non-enumerable text a plain walk cannot
+ * see.
+ *
+ * Throws: whatever a property getter on the value throws. `redactSecrets`, the
+ * only caller, catches it and returns `[UNREDACTABLE]` in place of the whole
+ * value it was given, rather than raising a getter's error at a caller who
+ * asked only for a copy it could log.
+ */
+function walkObject(current, deps) {
+    if (Array.isArray(current))
+        return current.map(deps.walk);
+    if (ArrayBuffer.isView(current))
+        return (0, secret_patterns_1.binaryLabel)(current);
+    if (isOpaqueValue(current))
+        return current;
+    if (isSetValue(current))
+        return [...current].map(deps.walk);
+    if (isMapValue(current))
+        return redactMap(current, deps);
+    const entries = Object.entries(current);
+    if (isErrorValue(current))
+        return redactError(current, entries, deps);
+    return redactEntries(entries, deps.keyPatterns, deps.walk);
+}

package/dist/shared/logging/secret-patterns.d.ts

@@ -1,7 +1,36 @@
+/**
+ * Hides what a secret looks like.
+ *
+ * Which key names mark their value as a secret, which credential formats are
+ * recognised in free text, how a match is replaced while the field's name is
+ * kept, and how a caught value's message is redacted before another error
+ * quotes it are decided here. The redacting logger and every error that
+ * quotes its cause share these rules, so a new credential shape is one edit.
+ */
 /** Marker substituted for anything recognised as secret. */
 export declare const REDACTED = "[REDACTED]";
-/** Key names (matched case-insensitively as substrings) whose value is a secret. */
+/**
+ * Key names whose value is a secret. Each entry is a *normalised* name — see
+ * {@link normaliseKey} — and matches a key whose normalised form equals it or
+ * ends with it. Suffix matching is what catches `secretAccessKey`, `x-api-key`,
+ * `client_secret` and `AUTH_TOKEN`; requiring the pattern to be a suffix, not a
+ * substring, is what spares `maxTokens`, `total_tokens`, `tokenizer` and
+ * `secretary` — a bare substring match would redact all four for merely
+ * containing `token` or `secret`.
+ */
 export declare const DEFAULT_SECRET_KEY_PATTERNS: readonly string[];
+/**
+ * Canonical form of a key name for matching.
+ *
+ * Accepts: any key name, in any case and with any separators.
+ *
+ * Returns: it lower-cased with every character that is not a letter or digit
+ * removed, so `api_key`, `x-api-key`, `ApiKey` and `API KEY` all become
+ * `apikey` and one pattern covers every spelling.
+ *
+ * Throws: nothing.
+ */
+export declare function normaliseKey(key: string): string;
 /**
  * Secret shapes recognisable in free text, where key-name matching cannot
  * reach: an error's `message`/`stack`, or any other string value. Deliberately
@@ -35,26 +64,105 @@ export declare const DEFAULT_SECRET_KEY_PATTERNS: readonly string[];
  *    this fallback from over-redacting sibling JSON fields.
  */
 export declare const DEFAULT_SECRET_VALUE_PATTERNS: readonly RegExp[];
-/** True when `key` matches any secret-key pattern. */
+/**
+ * Whether a key name says its value is a secret.
+ *
+ * Accepts: `key` — any name. `patterns` — already-normalised names; an empty
+ * list matches nothing, which is how a caller turns key matching off.
+ *
+ * Returns: whether the normalised key equals or *ends with* a pattern. Suffix,
+ * not substring: that is what catches `secretAccessKey` and `x-api-key` while
+ * sparing `maxTokens`, `tokenizer` and `secretary`.
+ *
+ * Throws: nothing.
+ */
 export declare function isSecretKey(key: string, patterns: readonly string[]): boolean;
+/**
+ * An error's message with recognised credential shapes redacted.
+ *
+ * Accepts: any error — and, since this is what a `catch` block binds, any
+ * other value a `throw` can produce: `null`, `undefined`, a string, a number,
+ * a symbol, a plain object. Such a value is described through {@link toError}
+ * first and the description is what is redacted, so a secret it carries in its
+ * own text is still caught.
+ *
+ * Returns: the message, redacted with the default value patterns and then
+ * bounded by `truncateRelayedText` — for embedding in another error's
+ * message, since a wrapper that quotes its cause must not leak a `password=`
+ * or token the cause happened to carry. That text reaches `err.message`, which
+ * an application may print without a redacting logger.
+ *
+ * The bound is here rather than at the sites that quote the result, so no call
+ * site can get it wrong and no future one has to remember: a `RETRY_EXHAUSTED`
+ * report, a wrapped AWS failure, a compensation failure and both S3 transfer
+ * errors all inherit it from this one line. Redaction runs **before** the cut,
+ * because cutting first could split a credential shape past the pattern that
+ * would have caught it. Its own cap rather than the identifier cap: this is
+ * prose, and `MAX_RELAYED_MESSAGE_CHARS` records what that number is
+ * measured against. The value worth bounding is not the AWS SDK's own text but
+ * a **caller's** — a `serde` refusal or a `vectorBackend` rejection, whose
+ * length the caller controls entirely and which some paths quote once per row.
+ *
+ * Throws: **nothing**, for any value. Reading `.message` off a thrown
+ * primitive yielded `undefined` and the redaction then raised a `TypeError` —
+ * from inside the `catch` that was reporting the real failure, and from the
+ * one function a static guard funnels every one of this package's `catch`
+ * blocks into. Its promise has to hold for what a `catch` actually binds, or
+ * the guard concentrates every site into a function that is not safe.
+ */
+export declare function redactedMessage(error: Error): string;
+/**
+ * Whether `value` is a regular expression.
+ *
+ * Accepts: anything, including a `RegExp` from another realm.
+ *
+ * Returns: whether its tag says so. By tag rather than `instanceof`, which is
+ * banned repo-wide because it answers "no" across a realm or a duplicated
+ * module.
+ *
+ * Throws: nothing.
+ */
+export declare function isRegExp(value: RegExp): boolean;
 /**
  * Replace every recognised secret shape inside `value` with {@link REDACTED},
  * leaving the surrounding text intact so a redacted message stays readable.
- * Each pattern is rebuilt per call so a `g` flag's `lastIndex` never leaks
- * between invocations.
- *
- * A pattern may capture a leading group it wants **preserved**: only the rest
- * of the match is replaced, which is what keeps `apiKey=[REDACTED]` saying
- * which field was redacted instead of collapsing to a bare marker. A pattern
- * with no group is replaced whole, as before. `String.prototype.replace`
- * passes the match *offset* — a number — as the second callback argument when
- * the pattern has no group, hence the `typeof` test rather than an
- * `undefined` check.
+ *
+ * Accepts: `value` — any text. `patterns` — applied in order, each against the
+ * result of the last; an empty list returns the text unchanged. An entry that
+ * is not a `RegExp` is skipped: reading `.source` off one produced
+ * `new RegExp(undefined)` — that is `/(?:)/`, which matches the empty string
+ * and prefixed the marker to every value while catching no secret at all.
+ * Both public entry points — `redactSecrets` and {@link redactLogger} — now
+ * refuse such an entry where it is supplied, since a skipped pattern protects
+ * nothing while its caller believes it does; skipping remains the last-ditch
+ * guard for a list this package assembles internally.
+ *
+ * Returns: the text with every match replaced. A pattern may capture a leading
+ * group it wants **preserved**: only the rest of the match is replaced, which
+ * keeps `apiKey=[REDACTED]` saying which field was redacted instead of
+ * collapsing to a bare marker. A pattern with no group is replaced whole.
+ * `String.prototype.replace` passes the match *offset* — a number — as the
+ * second callback argument when the pattern has no group, hence the `typeof`
+ * test rather than an `undefined` check.
+ *
+ * Throws: nothing.
+ *
+ * Guarantees: every pattern is applied globally and from a fresh copy, so
+ * neither a missing `g` flag nor a leftover `lastIndex` can leave a later
+ * occurrence in the clear.
  */
 export declare function redactText(value: string, patterns: readonly RegExp[]): string;
 /**
- * A short label for a binary view. Recursing one would explode it into a
- * per-index numeric map, both unreadable and far larger than the value itself.
+ * A short label for a binary view.
+ *
+ * Accepts: any `ArrayBufferView`.
+ *
+ * Returns: its type and byte length, e.g. `[Uint8Array(4096)]`. Recursing into
+ * one would explode it into a per-index numeric map, both unreadable and far
+ * larger than the value itself — and a payload is exactly the thing a log must
+ * not carry.
+ *
+ * Throws: nothing.
  */
 export declare function binaryLabel(value: ArrayBufferView): string;
 /** An Error's redacted non-enumerable text, plus whether redaction changed it. */
@@ -65,10 +173,32 @@ export interface RedactedErrorText {
     changed: boolean;
 }
 /**
- * Redact an Error's `name`/`message`/`stack`. `changed` reports whether any
- * secret was actually found, which is what decides between passing a bare
- * Error through by reference (preserving its identity and stack trace) and
- * rebuilding it so the secret cannot escape.
+ * Redact an Error's `name`, `message` and `stack`.
+ *
+ * Accepts: `error` — any error; a missing `stack` stays missing. Any other
+ * value a `throw` can produce is described through {@link toError} first, on
+ * the same reasoning as {@link redactedMessage}: the walk that calls this only
+ * reaches it for a value whose tag says `Error`, but the promise below is
+ * written in this function's own contract and is this function's to keep.
+ *
+ * Returns: the redacted text, plus `changed`: whether any secret was actually
+ * found. That flag is what decides between passing a bare Error through by
+ * reference — preserving its identity and stack trace — and rebuilding it so
+ * the secret cannot escape. It compares against the described error, so a
+ * value that had no text of its own is never reported as changed by the
+ * describing.
+ *
+ * None of the three is cut, and that is a decision rather than an omission.
+ * The rule that bounds unchecked text bounds what *this package* writes into
+ * its own `err.message` and its own log lines — `redactedMessage` is that
+ * funnel. This function is on the other side of the boundary: it rebuilds an
+ * Error the **consumer** handed to `redactSecrets`, or to the logger
+ * `redactLogger` wrapped, on the way to the consumer's own transport. Cutting
+ * there would change what their transport receives, for a value this package
+ * neither produced nor quotes, and the caller asked for redaction rather than
+ * for truncation. A consumer who wants a bound has their own transport to put
+ * one in.
+ *
+ * Throws: **nothing**, for any value.
  */
 export declare function redactErrorText(error: Error, patterns: readonly RegExp[]): RedactedErrorText;
-//# sourceMappingURL=secret-patterns.d.ts.map