@juspay/neurolink 13.8.26 → 13.8.27

package/dist/utils/logSanitize.d.ts

@@ -14,12 +14,16 @@
  *     tgp_ (Together), fw_ (Fireworks), pplx- (Perplexity), pa- (Voyage),
  *     jina_ (Jina), fish- (Fish Audio)
  *   - Generic key=value pairs: api_key=…, access_token: …, secret_key=…
+ *   - Bare JWTs (`eyJ…` header, payload and signature)
+ *   - Values of any key ending in `token`: breezeToken=…, "id_token": "…"
  */
 /**
- * Whether `key` names a value that must never appear in a log — the same list
- * {@link sanitizeRecord} masks, matched case-insensitively.
+ * Whether `key` names a value that must never appear in a log: a key on the
+ * list above, matched case-insensitively, or any key ending in `token`
+ * (`breezeToken`, `id_token`) unless its value is a number or boolean
+ * (`costPerToken`, `hasRefreshToken`).
  */
-export declare function isSensitiveLogKey(key: string): boolean;
+export declare function isSensitiveLogKey(key: string, value?: unknown): boolean;
 /**
  * Truncate `text` to `maxLen` chars then replace embedded secrets with `***`.
  *

package/dist/utils/logSanitize.js

@@ -14,6 +14,8 @@
  *     tgp_ (Together), fw_ (Fireworks), pplx- (Perplexity), pa- (Voyage),
  *     jina_ (Jina), fish- (Fish Audio)
  *   - Generic key=value pairs: api_key=…, access_token: …, secret_key=…
+ *   - Bare JWTs (`eyJ…` header, payload and signature)
+ *   - Values of any key ending in `token`: breezeToken=…, "id_token": "…"
  */
 import { createHash } from "crypto";
 import { basename, resolve as resolvePath } from "path";
@@ -47,7 +49,15 @@ const SECRET_PATTERN = new RegExp(
     // Bare tokens by known prefix (e.g. `sk-abc…`, `r8_xyz…`)
     `|\\b(?:${PREFIX_PATTERN})[_\\-][A-Za-z0-9_\\-\\.]{8,}\\b` +
     // Generic key=value pairs (URL params, JSON bodies, header dumps)
-    "|\\b(?:api[_-]?key|access[_-]?token|secret[_-]?key|refresh[_-]?token)['\"]?\\s*[:=]\\s*['\"]?[^\\s,;'\"&]+", "gi");
+    "|\\b(?:api[_-]?key|access[_-]?token|secret[_-]?key|refresh[_-]?token)['\"]?\\s*[:=]\\s*['\"]?[^\\s,;'\"&]+" +
+    // JWTs — the signature segment is empty on an unsigned token. A match
+    // starts only where a run of token characters starts, so `eyJ-eyJ-…`
+    // is scanned once rather than once per `eyJ`.
+    "|(?<![A-Za-z0-9_\\-])eyJ[A-Za-z0-9_\\-]{8,}\\.[A-Za-z0-9_\\-]+\\.[A-Za-z0-9_\\-]*" +
+    // Any other key ending in `token` (`breezeToken=…`, `"id_token":"…"`),
+    // as isSensitiveLogKey masks object keys: the key is kept, and a value
+    // that is a number, boolean or null is left alone
+    "|\\b([A-Za-z0-9_]*token['\"]?\\s*[:=]\\s*)(?:(['\"])[^'\"]*|(?!(?:true|false|null|-?\\d+(?:\\.\\d+)?(?:e[+-]?\\d+)?)(?![^\\s,;'\"&}\\])]))[^\\s,;'\"&}\\])]+)", "gi");
 /** Header names that should always be redacted regardless of value shape. */
 const SENSITIVE_HEADER_NAMES = [
     "authorization",
@@ -84,14 +94,22 @@ const SENSITIVE_OBJECT_KEYS = [
     "secretAccessKey",
     // PII, not a secret — but it has no business in debug log dumps.
     "userEmail",
+    "phoneNumber",
 ];
 /**
- * Whether `key` names a value that must never appear in a log — the same list
- * {@link sanitizeRecord} masks, matched case-insensitively.
+ * Whether `key` names a value that must never appear in a log: a key on the
+ * list above, matched case-insensitively, or any key ending in `token`
+ * (`breezeToken`, `id_token`) unless its value is a number or boolean
+ * (`costPerToken`, `hasRefreshToken`).
  */
-export function isSensitiveLogKey(key) {
+export function isSensitiveLogKey(key, value) {
     const lower = key.toLowerCase();
-    return SENSITIVE_OBJECT_KEYS.some((name) => name.toLowerCase() === lower);
+    if (SENSITIVE_OBJECT_KEYS.some((name) => name.toLowerCase() === lower)) {
+        return true;
+    }
+    return (lower.endsWith("token") &&
+        typeof value !== "number" &&
+        typeof value !== "boolean");
 }
 /**
  * Truncate `text` to `maxLen` chars then replace embedded secrets with `***`.
@@ -107,7 +125,9 @@ export function sanitizeForLog(text, maxLen = 500) {
     if (!text) {
         return text;
     }
-    return text.slice(0, maxLen).replace(SECRET_PATTERN, "***");
+    return text
+        .slice(0, maxLen)
+        .replace(SECRET_PATTERN, (_match, key, quote) => key === undefined ? "***" : `${key}${quote ?? ""}***`);
 }
 /**
  * Stringify non-string message/tool content without ever throwing.
@@ -530,12 +550,7 @@ export function sanitizeRecord(value, maxStringLen = 1000) {
         }
         const out = {};
         for (const [k, val] of Object.entries(v)) {
-            if (SENSITIVE_OBJECT_KEYS.some((name) => name.toLowerCase() === k.toLowerCase())) {
-                out[k] = "***";
-            }
-            else {
-                out[k] = walk(val);
-            }
+            out[k] = isSensitiveLogKey(k, val) ? "***" : walk(val);
         }
         return out;
     };

package/dist/utils/logger.js

@@ -14,7 +14,7 @@
  * - Tabular data display
  */
 import { AsyncLocalStorage } from "node:async_hooks";
-import { isSensitiveLogKey, sanitizeForLog, sanitizeRecord, } from "./logSanitize.js";
+import { isSensitiveLogKey, sanitizeForLog } from "./logSanitize.js";
 /**
  * Identifies which NeuroLink instance is emitting, for the async operation
  * currently on the stack. Populated by `runInInstanceScope()` — which the SDK
@@ -92,8 +92,6 @@ function cloneLogData(data) {
  * logger's "zero truncation" promise for debug data stands.
  */
 const REDACTION_STRING_CAP = 1_000_000;
-/** Depth past which a payload is handed to `sanitizeRecord` wholesale. */
-const REDACTION_MAX_DEPTH = 32;
 function isPlainObject(value) {
     const proto = Object.getPrototypeOf(value);
     return proto === Object.prototype || proto === null;
@@ -105,17 +103,21 @@ function isPlainObject(value) {
  * `sanitizeRecord` itself is not used directly on the whole payload because
  * its `Object.entries` walk flattens what debug data is full of: an `Error`
  * becomes `{}` (message and stack gone), a `Buffer` becomes thousands of
- * numeric keys, a `Date`/`Map`/`Set` becomes `{}`. Those are left as they are
- * — `serializeData` and `structuredClone` already know how to carry them —
- * and only plain containers are walked, with sensitive keys masked and
- * string values scrubbed of bearer tokens and known key prefixes. An `Error`
- * gets its message scrubbed in place of the instance.
+ * numeric keys, a `Date`/`Map`/`Set` becomes `{}`. Here binary data, dates
+ * and regexps are kept as they are, a `Map` or `Set` is copied with its
+ * entries redacted, and any other object is reduced to what `JSON.stringify`
+ * prints for it (its `toJSON()` result or its own fields) — the same fields
+ * the console and a `structuredClone` for a sink would expose. Sensitive keys
+ * are masked, strings scrubbed of bearer tokens and known key prefixes, an
+ * object reached by several paths is redacted once and its copy shared, a
+ * cycle becomes `"[Circular]"`, and an `Error` gets its message scrubbed in
+ * place of the instance.
  *
- * Cost: one recursive pass over objects a call site already chose to log,
- * and only when `shouldLog(level)` was true. Nothing runs for the 99% of
- * `logger.debug` calls that are filtered out.
+ * Cost: one pass over the objects a call site already chose to log, each
+ * redacted once, and only when `shouldLog(level)` was true. Nothing runs for
+ * the 99% of `logger.debug` calls that are filtered out.
  */
-function redactLogData(data, depth = 0) {
+function redactLogData(data, redacted = new Map()) {
     if (data === null || data === undefined) {
         return data;
     }
@@ -133,19 +135,47 @@ function redactLogData(data, depth = 0) {
             : undefined;
         return copy;
     }
-    if (depth >= REDACTION_MAX_DEPTH) {
-        return sanitizeRecord(data, REDACTION_STRING_CAP);
-    }
-    if (Array.isArray(data)) {
-        return data.map((item) => redactLogData(item, depth + 1));
-    }
-    if (!isPlainObject(data)) {
-        // Buffer, Date, Map, Set, class instances: carried as they are.
+    if (ArrayBuffer.isView(data) ||
+        data instanceof ArrayBuffer ||
+        data instanceof Date ||
+        data instanceof RegExp) {
         return data;
     }
+    if (redacted.has(data)) {
+        return redacted.get(data);
+    }
+    // Until this object's copy is built, a reference back to it is a cycle.
+    redacted.set(data, "[Circular]");
+    const copy = redactContainer(data, (value) => redactLogData(value, redacted));
+    redacted.set(data, copy);
+    return copy;
+}
+/** One level of {@link redactLogData}, for an object it has not seen yet. */
+function redactContainer(data, walk) {
+    if (Array.isArray(data)) {
+        return data.map(walk);
+    }
+    if (data instanceof Map) {
+        return new Map(Array.from(data, ([key, value]) => [
+            key,
+            typeof key === "string" && isSensitiveLogKey(key, value)
+                ? "***"
+                : walk(value),
+        ]));
+    }
+    if (data instanceof Set) {
+        return new Set(Array.from(data, walk));
+    }
+    if (!isPlainObject(data) &&
+        "toJSON" in data &&
+        typeof data.toJSON === "function") {
+        const json = data.toJSON();
+        return walk(json);
+    }
+    const entries = Object.entries(data);
     const out = {};
-    for (const [key, value] of Object.entries(data)) {
-        out[key] = isSensitiveLogKey(key) ? "***" : redactLogData(value, depth + 1);
+    for (const [key, value] of entries) {
+        out[key] = isSensitiveLogKey(key, value) ? "***" : walk(value);
     }
     return out;
 }
@@ -443,18 +473,33 @@ class NeuroLinkLogger {
      * @param message - The message text to log
      * @param data - Optional additional context data to include
      */
-    log(level, message, rawData) {
+    log(level, rawMessage, rawData) {
         if (!this.shouldLog(level)) {
             return;
         }
         // Central redaction: a `debug`/`info` payload is masked by key
-        // (`apiKey`, `authorization`, `credentials`, …) and scrubbed of
-        // bearer/known-prefix tokens before it is stored, emitted or printed, so
-        // the next `logger.debug("…", options)` cannot leak a credential into
-        // `getLogs()`, a `log-event` sink or the console. `warn`/`error` are
-        // left verbatim: they carry the diagnostics an operator is debugging
-        // with, and every credential-bearing path already redacts at source.
-        const data = level === "debug" || level === "info" ? redactLogData(rawData) : rawData;
+        // (`apiKey`, `authorization`, `credentials`, …), and it and the message
+        // are scrubbed of bearer/known-prefix tokens and JWTs before they are
+        // stored, emitted or printed, so the next `logger.debug("…", options)`
+        // cannot leak a credential into `getLogs()`, a `log-event` sink or the
+        // console. `warn`/`error` are left verbatim: they carry the diagnostics
+        // an operator is debugging with, and every credential-bearing path
+        // already redacts at source.
+        const redact = level === "debug" || level === "info";
+        const message = redact
+            ? sanitizeForLog(rawMessage, REDACTION_STRING_CAP)
+            : rawMessage;
+        let data = rawData;
+        if (redact) {
+            try {
+                data = redactLogData(rawData);
+            }
+            catch {
+                // Too deep (a stack overflow) or a throwing getter: drop the payload
+                // rather than log it unredacted or throw into the caller.
+                data = "[unredactable log data]";
+            }
+        }
         const entry = {
             level,
             message,
@@ -649,14 +694,17 @@ const neuroLinkLogger = new NeuroLinkLogger();
  * @param args - Array of arguments passed to the logger
  * @param logMethod - Function that will perform the actual logging
  */
-function processLoggerArgs(args, logMethod) {
+function processLoggerArgs(args, logMethod, redact = false) {
     if (args.length === 0) {
         return;
     }
-    // Serialize the first argument robustly to handle complex objects
+    // Serialize the first argument robustly to handle complex objects. An
+    // object is masked by key first: once it is a string, keys can't be found.
     const message = (() => {
         try {
-            return typeof args[0] === "string" ? args[0] : JSON.stringify(args[0]);
+            return typeof args[0] === "string"
+                ? args[0]
+                : JSON.stringify(redact ? redactLogData(args[0]) : args[0]);
         }
         catch {
             return "[Unserializable Object]";
@@ -679,12 +727,12 @@ function processLoggerArgs(args, logMethod) {
 export const logger = {
     debug: (...args) => {
         if (neuroLinkLogger.shouldLog("debug")) {
-            processLoggerArgs(args, (message, data) => neuroLinkLogger.debug(message, data));
+            processLoggerArgs(args, (message, data) => neuroLinkLogger.debug(message, data), true);
         }
     },
     info: (...args) => {
         if (neuroLinkLogger.shouldLog("info")) {
-            processLoggerArgs(args, (message, data) => neuroLinkLogger.info(message, data));
+            processLoggerArgs(args, (message, data) => neuroLinkLogger.info(message, data), true);
         }
     },
     warn: (...args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "13.8.26",
+  "version": "13.8.27",
   "packageManager": "pnpm@10.34.9+sha512.f49b5a8ea0fdedb44bb3c0c1d6575092a53c2950d95b7ad15df11f17974877a2de3a01c07e934e9b28ce716e51c09a94962c7306d09be2e1e4b18a8c8762fd32",
   "description": "The pipe layer of an AI nervous system: one interface connecting provider neurons to your application, across three inference types — generate, stream and decide. `decide` returns typed, calibrated judgements from a non-generative model (~400ms, ~$0.00002/call) for routing, tool selection and context budgeting. MCP-native (4 transports), voice TTS/STT/realtime, RAG, agents, memory, compaction, 9 observability exporters. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · TypeSafe Jev and more.",
   "author": {