@global-torque/invest-core 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.4.0 candidate
+
+- Reissued the framework cohort for the breaking redemption domain contract;
+  analytics and policy exports remain unchanged.
+
+## 0.3.1 candidate
+
+- Retain user, business, numeric, URL, and diagnostic analytics values while
+  redacting exact known credential fields across objects, JSON, FormData, and
+  URLSearchParams.
+- Preserve duplicate form values, circular/binary markers, and method-specific
+  request-body normalization without mutating caller data.
+
 ## 0.3.0 candidate
 
 - Require Node `^24.21.0`; Node 22 is no longer supported.

package/README.md

@@ -27,7 +27,9 @@ TypeScript browser and type targets and additionally provide exact generated
 candidate packer emits only these three Node files; all other exports remain
 source based.
 
-- `analytics/analyticsBody`: analytics request body normalization and redaction.
+- `analytics/analyticsBody`: analytics request body normalization with exact
+  credential-field redaction. User, business, numeric, URL, and diagnostic
+  values are retained unless assigned to a known credential field.
 - `decimal/canonicalDecimal`: numeric(38,18) canonical-string validation, exact scaled-integer arithmetic, comparison, and display formatting.
 - `evm/walletInfo`: EVM wallet status-only response normalization and deposit-address extraction.
 - `filer/publicImage`: pure public filer image URL and `srcset` builders with injected `filerUrl`.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@global-torque/invest-core",
   "private": false,
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Pure investment policy, calculations, formatters, and schema helpers.",
   "license": "MIT",
   "engines": {
@@ -67,7 +67,7 @@
   },
   "dependencies": {
     "@types/lodash": "^4.17.24",
-    "@global-torque/domain-types": "0.3.0",
+    "@global-torque/domain-types": "0.4.0",
     "ajv": "^8.20.0",
     "ajv-errors": "^3.0.0",
     "ajv-formats": "^3.0.1",

package/src/analytics/__tests__/analyticsBody.test.ts

@@ -6,45 +6,180 @@ import {
 import {
   normalizeAnalyticsBody,
   normalizeAnalyticsBodyForMethod,
+  sanitizeAnalyticsText,
+  sanitizeAnalyticsUrl,
 } from '../analyticsBody';
 
 describe('analyticsBody', () => {
-  it('redacts sensitive fields in object payloads', () => {
-    expect(normalizeAnalyticsBody({
+  it('removes exact credential fields while preserving user and business data', () => {
+    const input = {
       email: 'user@example.com',
+      firstName: 'Jamie',
+      address: '42 Main Street',
+      longId: '12345678901234567890',
+      token_symbol: 'USDC',
+      token_count: 12,
+      tokenNote: 'token is a business concept here',
       password: 'secret',
-      code: '123456',
       nested: {
-        routing_number: '021000021',
+        jwtToken: 'jwt-secret',
+        auth_code: 'auth-secret',
+        status_code: 200,
         note: 'Contact user@example.com before submitting',
-        tokenNote: 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwMTIzNDU2Nzg5MCJ9.signaturepart',
-        keep: true,
       },
-    })).toEqual({
-      email: '[redacted]',
+    };
+
+    expect(normalizeAnalyticsBody(input)).toEqual({
+      email: 'user@example.com',
+      firstName: 'Jamie',
+      address: '42 Main Street',
+      longId: '12345678901234567890',
+      token_symbol: 'USDC',
+      token_count: 12,
+      tokenNote: 'token is a business concept here',
       password: '[redacted]',
-      code: '[redacted]',
       nested: {
-        routing_number: '[redacted]',
-        note: 'Contact [redacted] before submitting',
-        tokenNote: '[redacted]',
-        keep: true,
+        jwtToken: '[redacted]',
+        auth_code: '[redacted]',
+        status_code: 200,
+        note: 'Contact user@example.com before submitting',
       },
     });
+    expect(input.password).toBe('secret');
+    expect(input.nested.jwtToken).toBe('jwt-secret');
   });
 
-  it('normalizes JSON strings and ignores invalid string bodies', () => {
-    expect(normalizeAnalyticsBody('{"first_name":"Jamie","keep":1}')).toEqual({
-      first_name: '[redacted]',
+  it('normalizes JSON strings and retains GET bodies', () => {
+    expect(normalizeAnalyticsBody('{"email":"user@example.com","token":"secret","keep":1}')).toEqual({
+      email: 'user@example.com',
+      token: '[redacted]',
       keep: 1,
     });
     expect(normalizeAnalyticsBody('not-json')).toEqual({});
+    expect(normalizeAnalyticsBodyForMethod('GET', { keep: true })).toEqual({ keep: true });
+    expect(normalizeAnalyticsBodyForMethod('POST', { keep: true })).toEqual({ keep: true });
+    expect(normalizeAnalyticsBodyForMethod('POST', undefined)).toEqual({});
   });
 
-  it('only includes bodies for mutation methods', () => {
-    expect(normalizeAnalyticsBodyForMethod('GET', { keep: true })).toEqual({});
-    expect(normalizeAnalyticsBodyForMethod('POST', { keep: true })).toEqual({ redacted: true });
-    expect(normalizeAnalyticsBodyForMethod('POST', undefined)).toEqual({});
-    expect(normalizeAnalyticsBodyForMethod('POST', '')).toEqual({});
+  it('redacts code only for the known csrf authentication record shape', () => {
+    expect(normalizeAnalyticsBody({ method: 'code', csrf_token: 'csrf', code: 'one', state: 'two' })).toEqual({
+      method: 'code',
+      csrf_token: '[redacted]',
+      code: '[redacted]',
+      state: 'two',
+    });
+    expect(normalizeAnalyticsBody({ method: 'code', code: 'keep', state: 'two' })).toEqual({
+      method: 'code',
+      code: 'keep',
+      state: 'two',
+    });
+    expect(normalizeAnalyticsBody({ method: 'code', csrf_token: 'csrf', status_code: 200 })).toEqual({
+      method: 'code',
+      csrf_token: '[redacted]',
+      status_code: 200,
+    });
+
+    expect(normalizeAnalyticsBody('{"method":"code","csrfToken":"csrf","code":"one","state":"two"}')).toEqual({
+      method: 'code',
+      csrfToken: '[redacted]',
+      code: '[redacted]',
+      state: 'two',
+    });
+  });
+
+  it('preserves duplicate FormData and URLSearchParams values while masking credentials', () => {
+    const formData = new FormData();
+    formData.append('email', 'user@example.com');
+    formData.append('email', 'second@example.com');
+    formData.append('method', 'code');
+    formData.append('csrf_token', 'csrf');
+    formData.append('code', 'one');
+    formData.append('code', 'two');
+    expect(normalizeAnalyticsBody(formData)).toMatchObject({
+      email: ['user@example.com', 'second@example.com'],
+      method: 'code',
+      csrf_token: '[redacted]',
+      code: ['[redacted]', '[redacted]'],
+    });
+
+    const params = new URLSearchParams();
+    params.append('email', 'user@example.com');
+    params.append('email', 'second@example.com');
+    params.append('token_symbol', 'USDC');
+    params.append('token', 'secret');
+    expect(normalizeAnalyticsBody(params)).toEqual({
+      email: ['user@example.com', 'second@example.com'],
+      token_symbol: 'USDC',
+      token: '[redacted]',
+    });
+
+    const authParams = new URLSearchParams('method=code&csrf_token=csrf&code=one&code=two&state=state');
+    expect(normalizeAnalyticsBody(authParams)).toEqual({
+      method: 'code',
+      csrf_token: '[redacted]',
+      code: ['[redacted]', '[redacted]'],
+      state: 'state',
+    });
+  });
+
+  it('handles cycles before arrays and preserves binary markers', () => {
+    const value: Record<string, unknown> = { name: 'user@example.com' };
+    const array: unknown[] = [];
+    array.push(array);
+    value.array = array;
+    value.file = new Blob(['contents']);
+    expect(normalizeAnalyticsBody(value)).toEqual({
+      name: 'user@example.com',
+      array: ['[circular]'],
+      file: '[binary]',
+    });
+  });
+
+  it('selectively preserves URL context and masks credential locations', () => {
+    const url = 'https://user:pass@example.test/path/token/CANARY?%74oken=CANARY&email=user@example.test&tag=one&tag=two#section';
+    const sanitized = sanitizeAnalyticsUrl(url);
+    expect(sanitized).toContain('https://example.test/path/token/[redacted]');
+    expect(sanitized).toContain('email=user%40example.test');
+    expect(sanitized).toContain('tag=one&tag=two');
+    expect(sanitized).toContain('#section');
+    expect(sanitized).not.toContain('CANARY');
+  });
+
+  it('sanitizes credential assignments and bearer values without broad PII matching', () => {
+    const text = 'user@example.com amount=123456789012 tokenNote=keep token=CANARY url=https://example.test/path?token=CANARY&email=user@example.com';
+    const sanitized = sanitizeAnalyticsText(text);
+    expect(sanitized).toContain('user@example.com');
+    expect(sanitized).toContain('123456789012');
+    expect(sanitized).toContain('tokenNote=keep');
+    expect(sanitized).not.toContain('token=CANARY');
+    expect(sanitized).not.toContain('?token=CANARY');
+    expect(sanitizeAnalyticsText('Failed /offers?%74oken=CANARY&email=user@example.test'))
+      .toBe('Failed /offers?token=%5Bredacted%5D&email=user%40example.test');
+    expect(sanitizeAnalyticsText('Open ../offers?email=user@example.test'))
+      .toBe('Open ../offers?email=user%40example.test');
+    expect(normalizeAnalyticsBody({
+      redirect_url: '/auth?%74oken=CANARY&email=user@example.test',
+    })).toEqual({
+      redirect_url: '/auth?token=%5Bredacted%5D&email=user%40example.test',
+    });
+  });
+
+  it('sanitizes nested text assignments and exact credential headers only', () => {
+    expect(sanitizeAnalyticsText('{"nested":{"password":"TEST_SECRET"},"email":"user@example.com"}'))
+      .toBe('{"nested":{"password":"[redacted]"},"email":"user@example.com"}');
+    expect(sanitizeAnalyticsText('https://host/path#%74oken=TEST_SECRET&tab=activity'))
+      .toBe('https://host/path#token=%5Bredacted%5D&tab=activity');
+    expect(sanitizeAnalyticsText('Cookie: session=TEST_SECRET; next=SECOND_SECRET'))
+      .toBe('Cookie: [redacted]');
+    expect(sanitizeAnalyticsText('preferred-cookie: chocolate email=user@example.com'))
+      .toBe('preferred-cookie: chocolate email=user@example.com');
+    expect(sanitizeAnalyticsText('message="failed password=CANARY for a@example.test"'))
+      .toBe('message="failed password=[redacted] for a@example.test"');
+    expect(sanitizeAnalyticsText('{"authorization":"Bearer CANARY","password":"SECOND_SECRET","email":"user@example.com"}'))
+      .toBe('{"authorization":"Bearer [redacted]","password":"[redacted]","email":"user@example.com"}');
+    expect(sanitizeAnalyticsText('{"proxy_authorization":"Basic CANARY","token":"SECOND_SECRET","email":"user@example.com"}'))
+      .toBe('{"proxy_authorization":"Basic [redacted]","token":"[redacted]","email":"user@example.com"}');
+    expect(sanitizeAnalyticsText('password="prefix[redacted]SECRET" token=abc%5Bredacted%5DSECRET'))
+      .toBe('password="[redacted]" token=[redacted]');
   });
 });

package/src/analytics/analyticsBody.ts

@@ -1,224 +1,314 @@
 import type { AnalyticsBody } from '@global-torque/domain-types/analyticsTypes';
 
-const MUTATION_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
 const REDACTED_VALUE = '[redacted]';
-const REDACTED_BODY: AnalyticsBody = { redacted: true };
-const SENSITIVE_EXACT_KEYS = new Set([
-  'address',
-  'address1',
-  'address2',
-  'city',
-  'country',
-  'account_holder_name',
-  'code',
-  'dob',
-  'email',
-  'first_name',
-  'full_name',
-  'ip_address',
-  'last_name',
-  'middle_name',
-  'postal_code',
-  'state',
-  'wallet',
-  'user_browser',
-  'zip',
-  'zip_code',
-]);
 const MAX_STRING_LENGTH = 500;
-const SENSITIVE_KEY_SUBSTRINGS = [
-  'account_number',
-  'csrf',
-  'passcode',
+
+/**
+ * Credential names are matched exactly after converting camel, kebab and
+ * spaced names to snake case. Business fields such as `token_symbol`,
+ * `token_count`, and `tokenNote` remain available.
+ */
+const CREDENTIAL_KEYS = new Set([
   'password',
-  'routing_number',
+  'create_password',
+  'repeat_password',
+  'current_password',
+  'new_password',
+  'confirm_password',
+  'token',
+  'jwt_token',
+  'access_token',
+  'refresh_token',
+  'id_token',
+  'auth_token',
+  'session_token',
+  'session_token_exchange_code',
+  'csrf',
+  'csrf_token',
+  'xsrf_token',
+  'authorization',
+  'proxy_authorization',
+  'cookie',
+  'set_cookie',
+  'api_key',
+  'x_api_key',
   'secret',
-  'social_security',
-  'ssn',
-  'tax_id',
+  'client_secret',
+  'private_key',
+  'seed_phrase',
+  'mnemonic',
+  'passcode',
+  'otp',
   'totp',
-] as const;
-const EMAIL_PATTERN = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
-const LONG_DIGIT_PATTERN = /\d{10,}/g;
-const JWT_LIKE_PATTERN = /\b[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{10,}\b/g;
-const BEARER_TOKEN_PATTERN = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/-]+=*/gi;
-const SECRET_ASSIGNMENT_PATTERN = /\b(access[_-]?token|refresh[_-]?token|id[_-]?token|auth[_-]?token|csrf[_-]?token|session[_-]?token|token|secret|client[_-]?secret|api[_-]?key|authorization|auth[_-]?code|verification[_-]?code|recovery[_-]?code|password|passcode|otp|totp|pin)\b\s*[:=]\s*("[^"]*"|'[^']*'|(?:Bearer|Basic)\s+[^\s,;&]+|[^\s,;&]+)/gi;
+  'pin',
+  'auth_code',
+  'verification_code',
+  'recovery_code',
+  'totp_code',
+  'link_token',
+  'challenge_signature',
+  'owner_signature',
+]);
+const COMPACT_CREDENTIAL_KEYS = new Set(
+  [...CREDENTIAL_KEYS].map((key) => key.replaceAll('_', '')),
+);
+
+const BEARER_TOKEN_PATTERN = /\b(Bearer|Basic)\s+[^\s,;&"'<>]+/giu;
+const URL_PATTERN = /https?:\/\/[^\s"'<>]+/giu;
+const RELATIVE_URL_PATTERN = /(^|[\s("'=])((?:\/{1,2}|\.\.?\/)[^\s"'<>]+)/gmu;
+const CREDENTIAL_HEADER_PATTERN = /(^|[^"'A-Za-z0-9_-])(cookie|set-cookie|authorization|proxy-authorization)\s*:\s*[^\r\n]*/gimu;
+
+/** Convert supported key spellings to one exact comparison form. */
+export const normalizeAnalyticsKey = (key: string): string => key
+  .trim()
+  .replace(/([a-z\d])([A-Z])/g, '$1_$2')
+  .replace(/[^A-Za-z\d]+/g, '_')
+  .replace(/^_+|_+$/g, '')
+  .toLowerCase();
+
+export const isCredentialKey = (key: string): boolean =>
+  CREDENTIAL_KEYS.has(normalizeAnalyticsKey(key))
+  || COMPACT_CREDENTIAL_KEYS.has(normalizeAnalyticsKey(key).replaceAll('_', ''));
+
+const escapeRegExp = (value: string): string => value.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+const CREDENTIAL_KEY_SPELLINGS = new Set(
+  [...CREDENTIAL_KEYS].flatMap((key) => [
+    key,
+    key.replace(/_([a-z])/gu, (_, letter: string) => letter.toUpperCase()),
+    key.replaceAll('_', '-'),
+    key.replaceAll('_', ''),
+  ]),
+);
+const CREDENTIAL_ASSIGNMENT_PATTERN = new RegExp(
+  `(?<![A-Za-z0-9_-])(["']?)(${[...CREDENTIAL_KEY_SPELLINGS].map(escapeRegExp).join('|')})\\1(\\s*[:=]\\s*)(?:(['"])((?:\\\\.|(?!\\4)[\\s\\S])*)\\4|([^\\s,;&}{"']+))`,
+  'giu',
+);
+
+/** Mask a credential assignment while retaining its label and surrounding text. */
+const maskCredentialAssignments = (value: string): string => value.replace(
+  CREDENTIAL_ASSIGNMENT_PATTERN,
+  (
+    match,
+    quote: string,
+    key: string,
+    separator: string,
+    valueQuote?: string,
+    quotedValue?: string,
+    unquotedValue?: string,
+  ) => {
+    const rawValue = quotedValue ?? unquotedValue ?? '';
+    if (
+      rawValue === REDACTED_VALUE
+      || /^%5bredacted%5d$/iu.test(rawValue)
+      || /^(?:Bearer|Basic)\s+\[redacted\]$/iu.test(rawValue)
+    ) return match;
+    return `${quote}${key}${quote}${separator}${valueQuote ? `${valueQuote}${REDACTED_VALUE}${valueQuote}` : REDACTED_VALUE}`;
+  },
+);
+
+const maskCredentialHeaders = (value: string): string => value.replace(
+  CREDENTIAL_HEADER_PATTERN,
+  (match, prefix: string, key: string) => `${prefix}${key}: [redacted]`,
+);
+
+const hasAbsoluteScheme = (value: string): boolean => /^[A-Za-z][A-Za-z\d+.-]*:/u.test(value);
+const hasProtocolRelativePrefix = (value: string): boolean => value.startsWith('//');
+
+const redactPathCredentialValues = (pathname: string): string => {
+  const segments = pathname.split('/');
+  return segments.map((segment, index) => {
+    const previous = segments[index - 1] ?? '';
+    let decodedPrevious = previous;
+    try {
+      decodedPrevious = decodeURIComponent(previous);
+    } catch {
+      // Keep the encoded segment when it is not valid URI encoding.
+    }
+    return isCredentialKey(decodedPrevious) ? '[redacted]' : segment;
+  }).join('/');
+};
 
+const maskCredentialFragment = (fragment: string): string => {
+  if (!fragment) return fragment;
+  const rawFragment = fragment.slice(1);
+  if (rawFragment.includes('=')) {
+    const params = new URLSearchParams(rawFragment);
+    const entries = [...params.entries()];
+    if (entries.some(([key]) => isCredentialKey(key))) {
+      const next = new URLSearchParams();
+      entries.forEach(([key, value]) => next.append(key, isCredentialKey(key) ? REDACTED_VALUE : value));
+      return `#${next.toString()}`;
+    }
+  }
+  return maskCredentialAssignments(fragment);
+};
+
+/** Preserve useful URL data while removing only known credential locations. */
+export const sanitizeAnalyticsUrl = (raw: string): string => {
+  if (!raw) return '';
+
+  const absolute = hasAbsoluteScheme(raw);
+  const protocolRelative = hasProtocolRelativePrefix(raw);
+  const base = 'https://analytics.local';
+
+  try {
+    const url = new URL(raw, base);
+    url.username = '';
+    url.password = '';
+    url.pathname = redactPathCredentialValues(url.pathname);
+
+    const entries = [...url.searchParams.entries()];
+    url.search = '';
+    entries.forEach(([key, value]) => {
+      url.searchParams.append(key, isCredentialKey(key) ? '[redacted]' : value);
+    });
+    url.hash = maskCredentialFragment(url.hash);
+
+    const serialized = url.toString();
+    if (absolute) return serialized;
+    if (protocolRelative) return `//${url.host}${url.pathname}${url.search}${url.hash}`;
+
+    const originalHadPath = raw.startsWith('/') || (!raw.startsWith('?') && !raw.startsWith('#'));
+    const relativePrefix = raw.match(/^(?:\.\.?\/)+/u)?.[0] ?? '';
+    const relativePath = originalHadPath ? url.pathname.replace(/^\//u, '') : '';
+    return `${raw.startsWith('/') ? url.pathname : `${relativePrefix}${relativePath}`}${url.search}${url.hash}`;
+  } catch {
+    return maskCredentialAssignments(raw);
+  }
+};
+
+/**
+ * Sanitize free-form diagnostics without treating ordinary user/business data
+ * as sensitive. Embedded URLs are processed first so useful URL context stays.
+ */
 export const sanitizeAnalyticsText = (
   raw: unknown,
   maxLength = MAX_STRING_LENGTH,
 ): string => {
-  if (raw == null) {
-    return '';
-  }
+  if (raw == null) return '';
 
   let sanitized = String(raw)
-    .replace(SECRET_ASSIGNMENT_PATTERN, '$1=[redacted]')
-    .replace(BEARER_TOKEN_PATTERN, '$1 [redacted]')
-    .replace(JWT_LIKE_PATTERN, REDACTED_VALUE)
-    .replace(EMAIL_PATTERN, REDACTED_VALUE)
-    .replace(LONG_DIGIT_PATTERN, REDACTED_VALUE);
+    .replace(URL_PATTERN, (url) => sanitizeAnalyticsUrl(url))
+    .replace(RELATIVE_URL_PATTERN, (match, prefix: string, url: string) => (
+      `${prefix}${sanitizeAnalyticsUrl(url)}`
+    ))
+    .replace(BEARER_TOKEN_PATTERN, '$1 [redacted]');
+  sanitized = maskCredentialHeaders(sanitized);
+  sanitized = maskCredentialAssignments(sanitized);
 
   if (sanitized.length > maxLength) {
-    sanitized = `${sanitized.slice(0, maxLength - 3)}...`;
+    sanitized = `${sanitized.slice(0, Math.max(0, maxLength - 3))}...`;
   }
 
   return sanitized;
 };
 
-const isSensitiveKey = (key: string): boolean => {
-  const normalized = key.trim().toLowerCase();
-
-  if (!normalized) {
-    return false;
-  }
-
-  if (SENSITIVE_EXACT_KEYS.has(normalized)) {
-    return true;
-  }
-
-  if (SENSITIVE_KEY_SUBSTRINGS.some((fragment) => normalized.includes(fragment))) {
-    return true;
-  }
-
-  if (
-    normalized === 'token'
-    || normalized.endsWith('token')
-    || normalized.startsWith('token')
-    || normalized.endsWith('_token')
-    || normalized.startsWith('token_')
-  ) {
-    return true;
-  }
-
-  return (
-    normalized === 'otp'
-    || normalized === 'pin'
-    || normalized.endsWith('_otp')
-    || normalized.endsWith('_pin')
-    || normalized.endsWith('otp')
-    || normalized.endsWith('pin')
-    || (
-      (normalized.endsWith('_code') || normalized.endsWith('code'))
-      && (
-        normalized.includes('otp')
-        || normalized.includes('totp')
-        || normalized.includes('pin')
-        || normalized.includes('verification')
-        || normalized.includes('recovery')
-      )
-    )
-  );
-};
-
 const isBlobSupported = () => typeof Blob !== 'undefined';
 const isFormDataSupported = () => typeof FormData !== 'undefined';
+const isUrlSearchParamsSupported = () => typeof URLSearchParams !== 'undefined';
 const isFileSupported = () => typeof File !== 'undefined';
 
 const normalizeBinaryValue = (value: Blob): string => {
-  if (isFileSupported() && value instanceof File && value.name.trim()) {
-    return '[binary]';
-  }
-
+  if (isFileSupported() && value instanceof File && value.name.trim()) return '[binary]';
   return '[binary]';
 };
 
-const normalizeObjectValue = (
-  value: Record<string, unknown>,
-  seen: WeakSet<object>,
-): AnalyticsBody => {
-  seen.add(value);
-
-  const normalized = Object.entries(value).reduce<AnalyticsBody>((result, [key, item]) => {
-    result[key] = isSensitiveKey(key)
-      ? REDACTED_VALUE
-      : normalizeBodyValue(item, seen);
-    return result;
-  }, {});
-
-  seen.delete(value);
-  return normalized;
+const isAuthCodeRecord = (value: Record<string, unknown>): boolean => {
+  const hasMethodCode = Object.entries(value).some(([key, item]) =>
+    normalizeAnalyticsKey(key) === 'method' && item === 'code');
+  const hasCsrfToken = Object.keys(value).some((key) =>
+    normalizeAnalyticsKey(key) === 'csrf_token');
+  return hasMethodCode && hasCsrfToken;
 };
 
-const appendFormDataEntry = (
-  target: AnalyticsBody,
-  key: string,
-  value: unknown,
-) => {
+const appendRepeatedValue = (target: AnalyticsBody, key: string, value: unknown): void => {
   const currentValue = target[key];
-
   if (typeof currentValue === 'undefined') {
     target[key] = value;
-    return;
+  } else {
+    target[key] = Array.isArray(currentValue)
+      ? [...currentValue, value]
+      : [currentValue, value];
   }
-
-  target[key] = Array.isArray(currentValue)
-    ? [...currentValue, value]
-    : [currentValue, value];
 };
 
-const normalizeFormData = (
-  formData: FormData,
-  seen: WeakSet<object>,
-): AnalyticsBody => {
+const normalizeFormData = (formData: FormData, seen: WeakSet<object>): AnalyticsBody => {
+  seen.add(formData);
+  const entries = [...formData.entries()];
+  const hasMethodCode = entries.some(([key, value]) => normalizeAnalyticsKey(key) === 'method' && value === 'code');
+  const hasCsrfToken = entries.some(([key]) => normalizeAnalyticsKey(key) === 'csrf_token');
   const normalized: AnalyticsBody = {};
 
-  for (const [key, value] of formData.entries()) {
-    appendFormDataEntry(
+  entries.forEach(([key, value]) => {
+    const redactCode = normalizeAnalyticsKey(key) === 'code' && hasMethodCode && hasCsrfToken;
+    appendRepeatedValue(
       normalized,
       key,
-      isSensitiveKey(key) ? REDACTED_VALUE : normalizeBodyValue(value, seen),
+      isCredentialKey(key) || redactCode ? '[redacted]' : normalizeBodyValue(value, seen),
     );
-  }
+  });
 
+  seen.delete(formData);
   return normalized;
 };
 
-const normalizeBodyValue = (
-  value: unknown,
-  seen: WeakSet<object>,
-): unknown => {
-  if (value == null) {
-    return null;
-  }
-
-  if (typeof value === 'string') {
-    return sanitizeAnalyticsText(value);
-  }
-
-  if (typeof value === 'boolean') {
-    return value;
-  }
-
-  if (typeof value === 'number') {
-    return Number.isFinite(value) ? value : null;
-  }
-
-  if (typeof value === 'bigint') {
-    return value.toString();
-  }
+const normalizeUrlSearchParams = (params: URLSearchParams, seen: WeakSet<object>): AnalyticsBody => {
+  seen.add(params);
+  const entries = [...params.entries()];
+  const hasMethodCode = entries.some(([key, value]) => normalizeAnalyticsKey(key) === 'method' && value === 'code');
+  const hasCsrfToken = entries.some(([key]) => normalizeAnalyticsKey(key) === 'csrf_token');
+  const normalized: AnalyticsBody = {};
 
-  if (value instanceof Date) {
-    return value.toISOString();
-  }
+  entries.forEach(([key, value]) => {
+    const redactCode = normalizeAnalyticsKey(key) === 'code' && hasMethodCode && hasCsrfToken;
+    appendRepeatedValue(
+      normalized,
+      key,
+      isCredentialKey(key) || redactCode ? '[redacted]' : normalizeBodyValue(value, seen),
+    );
+  });
 
-  if (isBlobSupported() && value instanceof Blob) {
-    return normalizeBinaryValue(value);
-  }
+  seen.delete(params);
+  return normalized;
+};
 
-  if (Array.isArray(value)) {
-    return value.map((item) => normalizeBodyValue(item, seen));
-  }
+const normalizeObjectValue = (
+  value: Record<string, unknown>,
+  seen: WeakSet<object>,
+): AnalyticsBody => {
+  seen.add(value);
+  const redactCode = isAuthCodeRecord(value);
+  const normalized = Object.entries(value).reduce<AnalyticsBody>((result, [key, item]) => {
+    result[key] = isCredentialKey(key) || (redactCode && normalizeAnalyticsKey(key) === 'code')
+      ? '[redacted]'
+      : normalizeBodyValue(item, seen);
+    return result;
+  }, {});
+  seen.delete(value);
+  return normalized;
+};
 
-  if (isFormDataSupported() && value instanceof FormData) {
-    return normalizeFormData(value, seen);
-  }
+const normalizeBodyValue = (value: unknown, seen: WeakSet<object>): unknown => {
+  if (value == null) return null;
+  if (typeof value === 'string') return sanitizeAnalyticsText(value);
+  if (typeof value === 'boolean') return value;
+  if (typeof value === 'number') return Number.isFinite(value) ? value : null;
+  if (typeof value === 'bigint') return value.toString();
+  if (value instanceof Date) return value.toISOString();
+  if (isBlobSupported() && value instanceof Blob) return normalizeBinaryValue(value);
 
   if (typeof value === 'object') {
-    if (seen.has(value as object)) {
-      return '[circular]';
+    if (seen.has(value as object)) return '[circular]';
+    if (Array.isArray(value)) {
+      seen.add(value);
+      const normalized = value.map((item) => normalizeBodyValue(item, seen));
+      seen.delete(value);
+      return normalized;
+    }
+    if (isFormDataSupported() && value instanceof FormData) return normalizeFormData(value, seen);
+    if (isUrlSearchParamsSupported() && value instanceof URLSearchParams) {
+      return normalizeUrlSearchParams(value, seen);
     }
-
     return normalizeObjectValue(value as Record<string, unknown>, seen);
   }
 
@@ -226,16 +316,11 @@ const normalizeBodyValue = (
 };
 
 export const normalizeAnalyticsBody = (value: unknown): AnalyticsBody => {
-  if (value == null) {
-    return {};
-  }
+  if (value == null) return {};
 
   if (typeof value === 'string') {
     const trimmedValue = value.trim();
-    if (!trimmedValue) {
-      return {};
-    }
-
+    if (!trimmedValue) return {};
     try {
       return normalizeAnalyticsBody(JSON.parse(trimmedValue));
     } catch {
@@ -243,28 +328,17 @@ export const normalizeAnalyticsBody = (value: unknown): AnalyticsBody => {
     }
   }
 
-  if (isFormDataSupported() && value instanceof FormData) {
-    return normalizeFormData(value, new WeakSet<object>());
+  const seen = new WeakSet<object>();
+  if (isFormDataSupported() && value instanceof FormData) return normalizeFormData(value, seen);
+  if (isUrlSearchParamsSupported() && value instanceof URLSearchParams) {
+    return normalizeUrlSearchParams(value, seen);
   }
-
-  if (typeof value !== 'object' || Array.isArray(value)) {
-    return {};
-  }
-
-  return normalizeObjectValue(value as Record<string, unknown>, new WeakSet<object>());
+  if (typeof value !== 'object' || Array.isArray(value)) return {};
+  return normalizeObjectValue(value as Record<string, unknown>, seen);
 };
 
+/** Normalize every method consistently; method remains part of the public API. */
 export const normalizeAnalyticsBodyForMethod = (
-  method: string | undefined,
+  _method: string | undefined,
   value: unknown,
-): AnalyticsBody => {
-  if (!method || !MUTATION_METHODS.has(method.toUpperCase())) {
-    return {};
-  }
-
-  if (value == null || (typeof value === 'string' && value.trim() === '')) {
-    return {};
-  }
-
-  return { ...REDACTED_BODY };
-};
+): AnalyticsBody => normalizeAnalyticsBody(value);