@farukada/aws-langgraph-dynamodb-ts 1.0.0-rc.1 → 1.0.0

package/dist/shared/errors/errors.js

@@ -1,114 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CompensationFailedError = exports.BatchWriteAllIncompleteError = exports.BatchWriteIncompleteError = exports.AbortError = exports.ResultTruncatedError = exports.RetryExhaustedError = exports.ConflictError = exports.ValidationError = void 0;
-const secret_patterns_1 = require("../logging/secret-patterns");
-const base_error_1 = require("./base-error");
-const error_code_1 = require("./error-code");
-/** Input failed a validation rule before any AWS call was made; `context.field` names the input. */
-class ValidationError extends base_error_1.DynamoDBLangGraphError {
-    constructor(message, field, cause) {
-        super(message, error_code_1.ErrorCode.VALIDATION, field === undefined ? {} : { field }, cause);
-        this.name = 'ValidationError';
-    }
-}
-exports.ValidationError = ValidationError;
-/** A conditional write failed because the precondition no longer holds. */
-class ConflictError extends base_error_1.DynamoDBLangGraphError {
-    constructor(message, cause) {
-        super(message, error_code_1.ErrorCode.CONDITION_CONFLICT, {}, cause);
-        this.name = 'ConflictError';
-    }
-}
-exports.ConflictError = ConflictError;
-/** A retried operation exhausted its attempt budget. */
-class RetryExhaustedError extends base_error_1.DynamoDBLangGraphError {
-    constructor(message, attempts, cause) {
-        super(message, error_code_1.ErrorCode.RETRY_EXHAUSTED, attempts === undefined ? {} : { attempts }, cause);
-        this.name = 'RetryExhaustedError';
-    }
-}
-exports.RetryExhaustedError = RetryExhaustedError;
-/**
- * A paginated read hit its runaway guard (item or iteration cap) while more
- * data remained, so the result would have been silently truncated. Narrow the
- * query (filter/prefix) or raise the cap rather than trusting a partial result.
- * `context.field` names the cap that was hit.
- */
-class ResultTruncatedError extends base_error_1.DynamoDBLangGraphError {
-    constructor(cap, limit) {
-        super(`paginated read truncated at the ${cap} cap (${limit}) with more data remaining`, error_code_1.ErrorCode.RESULT_TRUNCATED, { field: cap });
-        this.name = 'ResultTruncatedError';
-    }
-}
-exports.ResultTruncatedError = ResultTruncatedError;
-/** An operation was cancelled via its AbortSignal. */
-class AbortError extends base_error_1.DynamoDBLangGraphError {
-    constructor(message = 'Operation aborted', cause) {
-        super(message, error_code_1.ErrorCode.ABORTED, {}, cause);
-        this.name = 'AbortError';
-    }
-}
-exports.AbortError = AbortError;
-/**
- * A BatchWriteItem sequence could not drain its UnprocessedItems. Items NOT
- * listed in {@link unprocessed} were acked by DynamoDB and persist — there is
- * no rollback (drive reconciliation from `unprocessed`). `cause`, when given,
- * is the underlying failure that interrupted the drain (e.g. a thrown,
- * non-UnprocessedItems error from a retry round) rather than a clean exhaustion
- * of the UnprocessedItems retry budget.
- */
-class BatchWriteIncompleteError extends base_error_1.DynamoDBLangGraphError {
-    succeededCount;
-    unprocessed;
-    constructor(succeededCount, unprocessed, retries, cause) {
-        super(`batchWrite did not drain after ${retries} UnprocessedItems retries: ` +
-            `${succeededCount} item(s) persisted, ${unprocessed.length} still un-acked.`, error_code_1.ErrorCode.BATCH_WRITE_INCOMPLETE, {}, cause);
-        this.name = 'BatchWriteIncompleteError';
-        this.succeededCount = succeededCount;
-        this.unprocessed = unprocessed;
-    }
-}
-exports.BatchWriteIncompleteError = BatchWriteIncompleteError;
-/**
- * batchWriteAll attempts every chunk rather than stopping at the first
- * failure — a mid-sequence chunk failing does not abandon the chunks after
- * it. `failedChunks` holds each failing chunk's own error (commonly a
- * {@link BatchWriteIncompleteError}); every chunk not represented there
- * drained successfully and its writes persist — there is no rollback.
- * `succeededCount` is the exact number of individual write requests
- * confirmed persisted across every chunk (full chunks plus any failed
- * chunk's own partial drain), more precise than `succeededChunks` alone
- * when a chunk partially drains before exhausting its retries.
- */
-class BatchWriteAllIncompleteError extends base_error_1.DynamoDBLangGraphError {
-    succeededChunks;
-    totalChunks;
-    failedChunks;
-    succeededCount;
-    constructor(succeededChunks, totalChunks, failedChunks, succeededCount = 0) {
-        super(`batchWriteAll did not fully drain: ${succeededChunks}/${totalChunks} chunk(s) succeeded, ` +
-            `${failedChunks.length} chunk(s) failed. ${succeededCount} write(s) persisted before the failure.`, error_code_1.ErrorCode.BATCH_WRITE_INCOMPLETE, {}, failedChunks[0]);
-        this.name = 'BatchWriteAllIncompleteError';
-        this.succeededChunks = succeededChunks;
-        this.totalChunks = totalChunks;
-        this.failedChunks = failedChunks;
-        this.succeededCount = succeededCount;
-    }
-}
-exports.BatchWriteAllIncompleteError = BatchWriteAllIncompleteError;
-/**
- * A compensating rollback failed after an append-saga chunk error, so the
- * trigger error could not be cleanly undone. Carries the original trigger as
- * `cause` and the rollback failure as {@link rollbackError}; the session's
- * `messageCount` may have drifted — repair it with `reconcileMessageCount`.
- */
-class CompensationFailedError extends base_error_1.DynamoDBLangGraphError {
-    rollbackError;
-    constructor(cause, rollbackError) {
-        super(`compensation failed after an append error: ${(0, secret_patterns_1.redactedMessage)(cause)} ` +
-            `(rollback: ${(0, secret_patterns_1.redactedMessage)(rollbackError)})`, error_code_1.ErrorCode.COMPENSATION_FAILED, {}, cause);
-        this.name = 'CompensationFailedError';
-        this.rollbackError = rollbackError;
-    }
-}
-exports.CompensationFailedError = CompensationFailedError;

package/dist/shared/errors/upstream-error.d.ts

@@ -1,16 +0,0 @@
-import { DynamoDBLangGraphError } from './base-error';
-/**
- * A failure that originated below this library — the AWS SDK, the transport,
- * a third-party `VectorBackend` or `Embeddings` — and surfaced through one of
- * its public methods. Wrapping it keeps the promise that every rejection a
- * caller sees is a {@link DynamoDBLangGraphError} with a branchable `code`,
- * while losing nothing a support ticket needs: the SDK's own error name, the
- * request id and HTTP status when present, and the original as `cause`.
- */
-export declare class UpstreamError extends DynamoDBLangGraphError {
-    readonly upstreamName: string;
-    /** Declared, not emitted: absent metadata leaves no `undefined`-valued own property behind. */
-    readonly requestId?: string;
-    readonly httpStatusCode?: number;
-    constructor(cause: Error, operation: string);
-}

package/dist/shared/errors/upstream-error.js

@@ -1,27 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.UpstreamError = void 0;
-const base_error_1 = require("./base-error");
-const error_code_1 = require("./error-code");
-/**
- * A failure that originated below this library — the AWS SDK, the transport,
- * a third-party `VectorBackend` or `Embeddings` — and surfaced through one of
- * its public methods. Wrapping it keeps the promise that every rejection a
- * caller sees is a {@link DynamoDBLangGraphError} with a branchable `code`,
- * while losing nothing a support ticket needs: the SDK's own error name, the
- * request id and HTTP status when present, and the original as `cause`.
- */
-class UpstreamError extends base_error_1.DynamoDBLangGraphError {
-    upstreamName;
-    constructor(cause, operation) {
-        super(`${operation}: ${cause.name}: ${cause.message}`, error_code_1.ErrorCode.UPSTREAM, { operation }, cause);
-        this.name = 'UpstreamError';
-        this.upstreamName = cause.name;
-        const metadata = cause.$metadata;
-        if (metadata?.requestId !== undefined)
-            this.requestId = metadata.requestId;
-        if (metadata?.httpStatusCode !== undefined)
-            this.httpStatusCode = metadata.httpStatusCode;
-    }
-}
-exports.UpstreamError = UpstreamError;

package/dist/shared/errors/wrap-error.d.ts

@@ -1,7 +0,0 @@
-/**
- * Normalize a caught value (TypeScript types catch clauses as the implicit
- * unknown) into an `Error`. Error-shaped values pass through; anything else is
- * stringified into a fresh `Error`. This is the boundary where caught values
- * are narrowed — callers do `toError(error as Error)`.
- */
-export declare function toError(value: Error): Error;

package/dist/shared/errors/wrap-error.js

@@ -1,15 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.toError = toError;
-/**
- * Normalize a caught value (TypeScript types catch clauses as the implicit
- * unknown) into an `Error`. Error-shaped values pass through; anything else is
- * stringified into a fresh `Error`. This is the boundary where caught values
- * are narrowed — callers do `toError(error as Error)`.
- */
-function toError(value) {
-    if (value !== null && typeof value === 'object' && typeof value.message === 'string') {
-        return value;
-    }
-    return new Error(typeof value === 'string' ? value : JSON.stringify(value));
-}

package/dist/shared/logging/logger.d.ts

@@ -1,18 +0,0 @@
-/** A value safe to pass as a structured log argument. */
-export type LogArgument = string | number | boolean | null | object;
-/**
- * Pluggable logging interface — consumers supply their own implementation.
- * `args` are structured fields, at most one plain object per call, so an
- * adapter for a structured logger (pino, winston) can merge them into one
- * record; the message is a fixed string and never carries a value.
- */
-export interface Logger {
-    info(message: string, ...args: LogArgument[]): void;
-    warn(message: string, ...args: LogArgument[]): void;
-    error(message: string, ...args: LogArgument[]): void;
-    debug(message: string, ...args: LogArgument[]): void;
-}
-/** Default logger: discards everything. Inject a real logger to enable output. */
-export declare const SILENT_LOGGER: Logger;
-/** Return the injected logger, or {@link SILENT_LOGGER} when none is given. */
-export declare function resolveLogger(logger?: Logger): Logger;

package/dist/shared/logging/logger.js

@@ -1,15 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SILENT_LOGGER = void 0;
-exports.resolveLogger = resolveLogger;
-/** Default logger: discards everything. Inject a real logger to enable output. */
-exports.SILENT_LOGGER = {
-    info() { },
-    warn() { },
-    error() { },
-    debug() { },
-};
-/** Return the injected logger, or {@link SILENT_LOGGER} when none is given. */
-function resolveLogger(logger) {
-    return logger ?? exports.SILENT_LOGGER;
-}

package/dist/shared/logging/redaction-walk.d.ts

@@ -1,23 +0,0 @@
-/** A value that {@link redactSecrets} can recurse through. */
-export type Redactable = string | number | boolean | null | undefined | Redactable[] | {
-    [key: string]: Redactable;
-};
-/** Any `Redactable` that is a non-null object — what the walk dispatches on. */
-export type RedactableObject = Redactable[] | {
-    [key: string]: Redactable;
-};
-/** One step of the recursive walk, threaded into the entry helpers. */
-type Walk = (value: Redactable) => Redactable;
-/** Collaborators threaded through the recursive walk. */
-export interface WalkDeps {
-    keyPatterns: readonly string[];
-    valuePatterns: readonly RegExp[];
-    walk: Walk;
-}
-/**
- * Dispatch one non-null object by its shape: arrays and plain objects recurse,
- * binary views collapse to a label, `Date`/`RegExp` pass through by reference,
- * `Set`/`Map` render as their contents, and an Error takes the path above.
- */
-export declare function walkObject(current: RedactableObject, deps: WalkDeps): Redactable;
-export {};

package/dist/shared/logging/redaction-walk.js

@@ -1,112 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.walkObject = walkObject;
-const secret_patterns_1 = require("./secret-patterns");
-/** True when `value` is a Set, tested by tag so a cross-realm Set still matches. */
-function isSetValue(value) {
-    return Object.prototype.toString.call(value) === '[object Set]';
-}
-/** True when `value` is a Map, tested by tag so a cross-realm Map still matches. */
-function isMapValue(value) {
-    return Object.prototype.toString.call(value) === '[object Map]';
-}
-/**
- * True when `value` is an Error (or subclass) or a `DOMException` — which has
- * its own tag yet carries the same `name`/`message`/`stack` — tested by tag,
- * not `instanceof`, so a cross-realm error still matches.
- */
-function isErrorValue(value) {
-    const tag = Object.prototype.toString.call(value);
-    return tag === '[object Error]' || tag === '[object DOMException]';
-}
-/**
- * True for a value whose identity matters more than its own properties.
- * `Date` and `RegExp` have none, so recursing either would yield a bare `{}`.
- */
-function isOpaqueValue(value) {
-    const tag = Object.prototype.toString.call(value);
-    return tag === '[object Date]' || tag === '[object RegExp]';
-}
-/**
- * Rebuild entries into a plain object, redacting values at secret-looking
- * keys. Properties are defined, not assigned: `out['__proto__'] = …` would
- * replace the result's prototype (and drop the entry) instead of recording the
- * key as data.
- */
-function redactEntries(entries, keyPatterns, walk) {
-    const out = {};
-    for (const [key, value] of entries) {
-        Object.defineProperty(out, key, {
-            value: (0, secret_patterns_1.isSecretKey)(key, keyPatterns) ? secret_patterns_1.REDACTED : walk(value),
-            enumerable: true,
-            writable: true,
-            configurable: true,
-        });
-    }
-    return out;
-}
-/**
- * A Map's entries as an object. Keys are stringified so a non-string key is
- * still reported rather than dropped, and each is checked against the
- * secret-key patterns exactly as a plain object's own keys are.
- */
-function redactMap(value, deps) {
-    const entries = [...value].map(([key, entry]) => [String(key), entry]);
-    return redactEntries(entries, deps.keyPatterns, deps.walk);
-}
-/**
- * Rebuild an Error as a plain object carrying its redacted text alongside its
- * redacted own properties. The one exception is an Error with no own
- * enumerable data, no `cause`, no aggregated `errors`, and no secret in its
- * text: it is returned by reference so its identity and stack trace survive,
- * which is what keeps a caught error useful in a log.
- *
- * `cause` and `AggregateError.errors` are copied explicitly because both are
- * defined *non-enumerable* per spec, so `Object.entries` never sees them.
- * Without this the whole chain vanished on every rebuild — and the rebuild
- * always fires for this library's own error types, since each attaches an
- * enumerable `code`/`context`. A redacted `RetryExhaustedError` would then no
- * longer say whether the underlying failure was a throttle, a validation error
- * or a network fault, which is the entire reason it carries a cause. A bare
- * Error *with* a cause is rebuilt for the same reason: passing it by reference
- * would hand the caller whatever secret the cause carries. Recursing through
- * `walk` redacts the chain too, and the cycle guard handles a cause that
- * points back at its own wrapper.
- */
-function redactError(current, entries, deps) {
-    const text = (0, secret_patterns_1.redactErrorText)(current, deps.valuePatterns);
-    const aggregated = current.errors;
-    const bare = entries.length === 0 && current.cause === undefined && aggregated === undefined;
-    if (bare && !text.changed)
-        return current;
-    const out = redactEntries(entries, deps.keyPatterns, deps.walk);
-    out.name = text.name;
-    out.message = text.message;
-    out.stack = text.stack;
-    if (current.cause !== undefined)
-        out.cause = deps.walk(current.cause);
-    if (Array.isArray(aggregated))
-        out.errors = deps.walk(aggregated);
-    return out;
-}
-/**
- * Dispatch one non-null object by its shape: arrays and plain objects recurse,
- * binary views collapse to a label, `Date`/`RegExp` pass through by reference,
- * `Set`/`Map` render as their contents, and an Error takes the path above.
- */
-function walkObject(current, deps) {
-    if (Array.isArray(current))
-        return current.map(deps.walk);
-    if (ArrayBuffer.isView(current))
-        return (0, secret_patterns_1.binaryLabel)(current);
-    if (isOpaqueValue(current))
-        return current;
-    if (isSetValue(current))
-        return [...current].map(deps.walk);
-    if (isMapValue(current))
-        return redactMap(current, deps);
-    const entries = Object.entries(current);
-    if (isErrorValue(current))
-        return redactError(current, entries, deps);
-    return redactEntries(entries, deps.keyPatterns, deps.walk);
-}

package/dist/shared/logging/redaction.d.ts

@@ -1,39 +0,0 @@
-import type { LogArgument, Logger } from './logger';
-import { type Redactable } from './redaction-walk';
-/**
- * Recursively clone `value`, replacing any value at a secret-looking key with
- * `[REDACTED]` and any recognised secret *shape* inside a string — including an
- * error's `message`/`stack` text, which key-name matching cannot reach — with
- * the same marker. Cycles become `[Circular]`.
- *
- * An Error with no own enumerable properties whose text holds no secret is
- * passed through by reference, so its identity and stack trace survive; one
- * carrying own data (this library's error types all attach `code`/`context`
- * this way) or a secret in its text is rebuilt instead, with `name`/`message`/
- * `stack` redacted and every other own property recursed like a plain object.
- * `Date`/`RegExp` keep their identity rather than collapsing to `{}`,
- * `Set`/`Map` render as their contents, and binary views become a short label.
- * Does not mutate the input. Accepts any log argument — a typed `Error`, a
- * class instance, a `Record` — so callers never cast.
- */
-export declare function redactSecrets(value: LogArgument | undefined, patterns?: readonly string[], valuePatterns?: readonly RegExp[]): Redactable;
-/** Options controlling {@link redactLogger}. */
-export interface RedactLoggerOptions {
-    /**
-     * Additional key names to redact. Matched like the defaults: a key is
-     * redacted when its normalised form (lower-case, punctuation removed) equals
-     * or ends with the normalised name, so `'ssn'` covers `SSN` and `user_ssn`.
-     */
-    extraKeys?: readonly string[];
-    /**
-     * Additional secret shapes to redact wherever they appear inside a string.
-     * A pattern's first capture group, if it has one, is preserved verbatim and
-     * only the remainder of the match is replaced.
-     */
-    extraValuePatterns?: readonly RegExp[];
-}
-/**
- * Wrap a logger so object args are redacted before delegation. The message
- * string is passed through unchanged (never interpolate secrets into it).
- */
-export declare function redactLogger(inner: Logger, options?: RedactLoggerOptions): Logger;

package/dist/shared/logging/redaction.js

@@ -1,75 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.redactSecrets = redactSecrets;
-exports.redactLogger = redactLogger;
-const redaction_walk_1 = require("./redaction-walk");
-const secret_patterns_1 = require("./secret-patterns");
-/** Substituted for a log argument whose redaction itself failed (a throwing getter, say). */
-const UNREDACTABLE = '[UNREDACTABLE]';
-/**
- * Recursively clone `value`, replacing any value at a secret-looking key with
- * `[REDACTED]` and any recognised secret *shape* inside a string — including an
- * error's `message`/`stack` text, which key-name matching cannot reach — with
- * the same marker. Cycles become `[Circular]`.
- *
- * An Error with no own enumerable properties whose text holds no secret is
- * passed through by reference, so its identity and stack trace survive; one
- * carrying own data (this library's error types all attach `code`/`context`
- * this way) or a secret in its text is rebuilt instead, with `name`/`message`/
- * `stack` redacted and every other own property recursed like a plain object.
- * `Date`/`RegExp` keep their identity rather than collapsing to `{}`,
- * `Set`/`Map` render as their contents, and binary views become a short label.
- * Does not mutate the input. Accepts any log argument — a typed `Error`, a
- * class instance, a `Record` — so callers never cast.
- */
-function redactSecrets(value, patterns = secret_patterns_1.DEFAULT_SECRET_KEY_PATTERNS, valuePatterns = secret_patterns_1.DEFAULT_SECRET_VALUE_PATTERNS) {
-    const seen = new WeakSet();
-    const walk = (current) => {
-        if (typeof current === 'string')
-            return (0, secret_patterns_1.redactText)(current, valuePatterns);
-        if (current === null || typeof current !== 'object')
-            return current;
-        if (seen.has(current))
-            return '[Circular]';
-        seen.add(current);
-        try {
-            return (0, redaction_walk_1.walkObject)(current, { keyPatterns: patterns, valuePatterns, walk });
-        }
-        finally {
-            seen.delete(current);
-        }
-    };
-    return walk(value);
-}
-/**
- * Redact one log argument, never throwing: an argument whose redaction fails
- * (a getter that throws, an exotic object) is replaced by a fixed marker rather
- * than either leaking unredacted or failing the library operation that logged.
- */
-function safeRedact(arg, patterns, valuePatterns) {
-    try {
-        return redactSecrets(arg, patterns, valuePatterns);
-    }
-    catch {
-        return UNREDACTABLE;
-    }
-}
-/**
- * Wrap a logger so object args are redacted before delegation. The message
- * string is passed through unchanged (never interpolate secrets into it).
- */
-function redactLogger(inner, options = {}) {
-    const patterns = options.extraKeys
-        ? [...secret_patterns_1.DEFAULT_SECRET_KEY_PATTERNS, ...options.extraKeys.map(secret_patterns_1.normaliseKey)]
-        : secret_patterns_1.DEFAULT_SECRET_KEY_PATTERNS;
-    const valuePatterns = options.extraValuePatterns
-        ? [...secret_patterns_1.DEFAULT_SECRET_VALUE_PATTERNS, ...options.extraValuePatterns]
-        : secret_patterns_1.DEFAULT_SECRET_VALUE_PATTERNS;
-    const wrap = (args) => args.map((arg) => safeRedact(arg, patterns, valuePatterns));
-    return {
-        info: (message, ...args) => inner.info(message, ...wrap(args)),
-        warn: (message, ...args) => inner.warn(message, ...wrap(args)),
-        error: (message, ...args) => inner.error(message, ...wrap(args)),
-        debug: (message, ...args) => inner.debug(message, ...wrap(args)),
-    };
-}

package/dist/shared/logging/secret-patterns.d.ts

@@ -1,92 +0,0 @@
-/** Marker substituted for anything recognised as secret. */
-export declare const REDACTED = "[REDACTED]";
-/**
- * Key names whose value is a secret. Each entry is a *normalised* name — see
- * {@link normaliseKey} — and matches a key whose normalised form equals it or
- * ends with it. Suffix matching is what catches `secretAccessKey`, `x-api-key`,
- * `client_secret` and `AUTH_TOKEN`; requiring the pattern to be a suffix, not a
- * substring, is what spares `maxTokens`, `total_tokens`, `tokenizer` and
- * `secretary`, which the old substring rule redacted.
- */
-export declare const DEFAULT_SECRET_KEY_PATTERNS: readonly string[];
-/**
- * Canonical form of a key name for matching: lower-case with every character
- * that is not a letter or digit removed, so `api_key`, `x-api-key`, `ApiKey`
- * and `API KEY` all become `apikey`.
- */
-export declare function normaliseKey(key: string): string;
-/**
- * Secret shapes recognisable in free text, where key-name matching cannot
- * reach: an error's `message`/`stack`, or any other string value. Deliberately
- * high-confidence — each pattern describes a credential *format* rather than a
- * word that merely sounds sensitive — so ordinary operational text survives
- * redaction unchanged.
- *
- * The credential-pair pattern (last) tolerates a **closing quote after the
- * keyword**, because that is what `JSON.stringify` produces
- * (`{"password":"…"}`) and requiring the separator to follow the bare keyword
- * matched nothing at all there — a silent, complete bypass on the single most
- * common shape a downstream HTTP error arrives in. Its group 1 is the keyword
- * and separator, preserved by {@link redactText}.
- *
- * Its value side tries three shapes, and their order is load-bearing:
- * 1. a fully-quoted span that consumes escapes, so `{"password":"a\"b"}` is
- *    redacted whole. Ending the span at the escaped quote stopped the
- *    redaction short and printed the rest of the secret verbatim.
- * 2. an unquoted JSON scalar — number, `true`, `false`, `null` — required to
- *    end at a real delimiter — `,`, `}`, `]` or end of input, optionally
- *    preceded by whitespace. Without this alternative,
- *    `{"apiKey":123,"region":"us-east-1"}` fell through to the fallback below,
- *    which then destroyed every sibling field after the secret. The lookahead
- *    is what stops the alternative truncating a value it does not fully
- *    describe, such as `token=123abc`, and leaking the tail it left behind.
- *    Whitespace alone does not end a scalar: treating a space as a delimiter
- *    made `api_key: 5 items` redact to `api_key: [REDACTED] items`, which
- *    reads as a partial redaction of a value the pattern never described.
- * 3. the rest of the line, so a multi-word secret is redacted whole instead of
- *    up to its first space. Trying the two precise shapes first is what keeps
- *    this fallback from over-redacting sibling JSON fields.
- */
-export declare const DEFAULT_SECRET_VALUE_PATTERNS: readonly RegExp[];
-/** True when `key`'s normalised form equals or ends with any (normalised) pattern. */
-export declare function isSecretKey(key: string, patterns: readonly string[]): boolean;
-/**
- * An error's message with recognised credential shapes redacted, for embedding
- * in another error's message: a wrapper that quotes its cause must not leak a
- * `password=` or token the cause happened to carry.
- */
-export declare function redactedMessage(error: Error): string;
-/**
- * Replace every recognised secret shape inside `value` with {@link REDACTED},
- * leaving the surrounding text intact so a redacted message stays readable.
- * Each pattern is rebuilt per call so a `g` flag's `lastIndex` never leaks
- * between invocations.
- *
- * A pattern may capture a leading group it wants **preserved**: only the rest
- * of the match is replaced, which is what keeps `apiKey=[REDACTED]` saying
- * which field was redacted instead of collapsing to a bare marker. A pattern
- * with no group is replaced whole, as before. `String.prototype.replace`
- * passes the match *offset* — a number — as the second callback argument when
- * the pattern has no group, hence the `typeof` test rather than an
- * `undefined` check.
- */
-export declare function redactText(value: string, patterns: readonly RegExp[]): string;
-/**
- * A short label for a binary view. Recursing one would explode it into a
- * per-index numeric map, both unreadable and far larger than the value itself.
- */
-export declare function binaryLabel(value: ArrayBufferView): string;
-/** An Error's redacted non-enumerable text, plus whether redaction changed it. */
-export interface RedactedErrorText {
-    name: string;
-    message: string;
-    stack: string | undefined;
-    changed: boolean;
-}
-/**
- * Redact an Error's `name`/`message`/`stack`. `changed` reports whether any
- * secret was actually found, which is what decides between passing a bare
- * Error through by reference (preserving its identity and stack trace) and
- * rebuilding it so the secret cannot escape.
- */
-export declare function redactErrorText(error: Error, patterns: readonly RegExp[]): RedactedErrorText;