@onesi/genesis 0.2.2 → 0.2.4

package/dist/redact.d.ts

@@ -1,9 +1,3 @@
-/**
- * Redaction for service error bodies and messages before the CLI or MCP prints them. The design is
- * conservative: when a key or value might be a secret, it is replaced with `[redacted]`. Field names are
- * matched after normalisation (camelCase split, `-`/`.`/space to `_`, lower-cased), so `x-api-key`,
- * `privateKey`, `Set-Cookie` and `client_secret` are all the same kind of name.
- */
 export declare const REDACTED = "[redacted]";
 /** Bounds of the printed body: serialized bytes, per string, per array/object, nesting and the oversize preview. */
 export declare const ERROR_BODY_LIMITS: {

package/dist/redact.js

@@ -4,6 +4,7 @@
  * matched after normalisation (camelCase split, `-`/`.`/space to `_`, lower-cased), so `x-api-key`,
  * `privateKey`, `Set-Cookie` and `client_secret` are all the same kind of name.
  */
+import { redactUserinfo } from './urls.js';
 export const REDACTED = '[redacted]';
 /** Bounds of the printed body: serialized bytes, per string, per array/object, nesting and the oversize preview. */
 export const ERROR_BODY_LIMITS = { bytes: 16384, string: 2048, items: 100, depth: 8, preview: 4096 };
@@ -174,8 +175,8 @@ const SECRET_TEXT = [
     [/(?<![A-Za-z0-9])ek_(?:live|test)_[A-Za-z0-9_-]{8,}/g, REDACTED],
     // PEM private keys (whole block, or to the end when cut).
     [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, REDACTED],
-    // URL userinfo: scheme://user:pass@host.
-    [/\b([a-z][a-z0-9+.-]{0,31}:\/\/)[^\s/?#@]+@/gi, `$1${REDACTED}@`],
+    // URL userinfo: scheme://user:pass@host, and the scheme-less, protocol-relative, percent-encoded and JSON-escaped forms.
+    [/^[\s\S]*$/, (t) => redactUserinfo(t, REDACTED)],
     // An Authorization / Proxy-Authorization header in text, any scheme.
     [/\b((?:proxy[-_ ]?)?authorization["']?\s*[:=]\s*["']?)(?!\[redacted\])(?:[A-Za-z][A-Za-z0-9_-]*\s+)?[^\s"',;]{8,}/gi, `$1${REDACTED}`],
     // Auth schemes followed by a credential.

package/dist/urls.d.ts

@@ -4,3 +4,12 @@
  * Credentials ride on every request, so a plain-http endpoint off the local machine is refused.
  */
 export declare function requireSecureUrl(value: string, what: string): string;
+/**
+ * Replace the userinfo of every URL in `text` with `mask` (default `***`): `https://user:pass@host` becomes
+ * `https://***@host` and `user:pass@host` becomes `***@host`, including scheme-less, protocol-relative,
+ * percent-encoded (also double-encoded) and JSON-escaped forms, and passwords holding an unencoded `@`.
+ * Linear time on any input. Use on error and status text only, never on data the user asked to see.
+ */
+export declare function redactUserinfo(text: string, mask?: string): string;
+/** `url` without its userinfo (`https://u:p@host/x` becomes `https://host/x`); text that is not an absolute URL passes through redactUserinfo. */
+export declare function stripUserinfo(url: string): string;

package/dist/urls.js

@@ -29,3 +29,64 @@ export function requireSecureUrl(value, what) {
         return value;
     throw new Error(`${what} must use https (http is allowed only on loopback hosts)`);
 }
+// The scheme before the slashes is left as it is, so it is never matched. Every quantifier is bounded (userinfo 512, bare user 64 / password 128) and none is nested or overlaps
+// another, so one start position costs O(1). On top of that, only the stretches within WINDOW characters before an
+// `@` (or `%40`) are scanned at all: a userinfo cannot end anywhere else. Redaction is therefore linear in the text
+// length times a constant, and text with no `@`, fullwidth `＠` or `%40` is returned as it is.
+// scheme://userinfo@, //userinfo@, https:/\userinfo@ and JSON-escaped :\/\/userinfo@ (greedy to the last @ before the path).
+const USERINFO = /([/\\]{2}|\\\/\\\/)[^\s/?#\\"'<>]{0,512}[@＠]/gi;
+// The same, percent-encoded (also double-encoded): https%3A%2F%2Fuser%3Apass%40host, https%253A%252F%252Fuser%2540host.
+const ENCODED_USERINFO = /(%(?:25){0,2}2F%(?:25){0,2}2F)(?:(?!%(?:25){0,2}2F)[^\s/?#&"'<>]){0,512}%(?:25){0,2}40/gi;
+// Scheme-less user:pass@host (a colon is required, so plain addresses like user@host are left alone).
+const BARE_USERINFO = /(^|[\s"'(<=,;[{])[^\s/?#@＠:"'<>\\]{1,64}:[^\s/?#"'<>\\]{0,128}[@＠](?=[\w[])/g;
+/** Every place a userinfo can end: `@`, fullwidth `＠`, or an encoded `%40` / `%2540`. */
+const AT_HITS = /[@＠]|%(?:25){0,2}40/gi;
+/** The longest URL-form match (slashes and userinfo, encoded) is under 640 characters; the bare form is under 200. */
+const URL_WINDOW = 700;
+const BARE_WINDOW = 200;
+/** Apply `fn` to the stretches of `text` within `window` characters before an `@`-like hit, and copy the rest as it is. */
+function overHits(text, window, fn) {
+    AT_HITS.lastIndex = 0;
+    let hit = AT_HITS.exec(text);
+    if (!hit)
+        return text;
+    let out = '';
+    let copied = 0;
+    let start = Math.max(0, hit.index - window);
+    let end = hit.index + hit[0].length + 1;
+    const flush = () => {
+        // A sentinel before a window that does not start the text keeps `^` (start of text) from matching mid-text.
+        const piece = start > 0 ? fn(`x${text.slice(start, end)}`).slice(1) : fn(text.slice(start, end));
+        out += text.slice(copied, start) + piece;
+        copied = Math.min(end, text.length);
+    };
+    for (hit = AT_HITS.exec(text); hit; hit = AT_HITS.exec(text)) {
+        const s = Math.max(0, hit.index - window);
+        if (s <= end) {
+            end = hit.index + hit[0].length + 1;
+            continue;
+        }
+        flush();
+        start = s;
+        end = hit.index + hit[0].length + 1;
+    }
+    flush();
+    return out + text.slice(copied);
+}
+/**
+ * Replace the userinfo of every URL in `text` with `mask` (default `***`): `https://user:pass@host` becomes
+ * `https://***@host` and `user:pass@host` becomes `***@host`, including scheme-less, protocol-relative,
+ * percent-encoded (also double-encoded) and JSON-escaped forms, and passwords holding an unencoded `@`.
+ * Linear time on any input. Use on error and status text only, never on data the user asked to see.
+ */
+export function redactUserinfo(text, mask = '***') {
+    // Pre-check: no `@`, `＠` or `%40` means no userinfo in any form.
+    if (!/[@＠]|%(?:25){0,2}40/i.test(text))
+        return text;
+    const urlForms = overHits(text, URL_WINDOW, (t) => t.replace(ENCODED_USERINFO, `$1${mask}%40`).replace(USERINFO, `$1${mask}@`));
+    return overHits(urlForms, BARE_WINDOW, (t) => t.replace(BARE_USERINFO, `$1${mask}@`));
+}
+/** `url` without its userinfo (`https://u:p@host/x` becomes `https://host/x`); text that is not an absolute URL passes through redactUserinfo. */
+export function stripUserinfo(url) {
+    return /^[a-z][a-z0-9+.-]*:\/\//i.test(url) ? url.replace(/^([a-z][a-z0-9+.-]*:\/\/)[^/?#]*@/i, '$1') : redactUserinfo(url);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onesi/genesis",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/l1felabs/genesis-api.git",