@ontrails/core 1.0.0-beta.3 → 1.0.0-beta.32

package/src/permits.ts

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+
+/** Minimal permit shape available on TrailContext. */
+export interface BasePermit {
+  readonly id: string;
+  readonly scopes: readonly string[];
+}
+
+export const basePermitSchema: z.ZodType<BasePermit> = z.object({
+  id: z.string(),
+  scopes: z.array(z.string()).readonly(),
+});

package/src/redaction/patterns.ts

@@ -16,11 +16,14 @@ export const DEFAULT_PATTERNS: RegExp[] = [
   // SSN: XXX-XX-XXXX
   /\b\d{3}-\d{2}-\d{4}\b/g,
 
-  // Bearer tokens
-  /Bearer\s+[A-Za-z0-9\-._~+/]+=*/g,
+  // Bearer tokens. Keep the threshold above short prose like "Bearer token".
+  /Bearer\s+[A-Za-z0-9\-._~+/=]{6,}/g,
 
   // Basic auth
-  /Basic\s+[A-Za-z0-9+/]+=*/g,
+  /Basic\s+[A-Za-z0-9+/=]{8,}/g,
+
+  // Common key/value secrets embedded in strings
+  /\b(?:password|secret|token|api[_-]?key|cookie)\s*[:=]\s*[^\s,;]+/gi,
 
   // API keys: sk-*, pk_*, sk_* prefixed tokens
   /\b(?:sk-|pk_|sk_)[A-Za-z0-9_-]{8,}\b/g,

package/src/resilience.ts

@@ -61,11 +61,11 @@ const sleep = (ms: number, signal?: AbortSignal): Promise<void> =>
 export const shouldRetry = (error: Error): boolean => isRetryable(error);
 
 // ---------------------------------------------------------------------------
-// getBackoffDelay
+// deriveBackoffDelay
 // ---------------------------------------------------------------------------
 
 /** Compute exponential backoff delay with full jitter. */
-export const getBackoffDelay = (
+export const deriveBackoffDelay = (
   attempt: number,
   options?: Pick<RetryOptions, 'baseDelay' | 'maxDelay' | 'backoffFactor'>
 ): number => {
@@ -108,7 +108,7 @@ const tryAttempt = async <T>(
   if (isLast || !retryPredicate(result.error)) {
     return { done: true, result };
   }
-  const delay = getBackoffDelay(attempt, options);
+  const delay = deriveBackoffDelay(attempt, options);
   if (delay > 0) {
     await sleep(delay, options?.signal);
   }
@@ -203,10 +203,9 @@ export const withTimeout = <T>(
       );
     }, ms);
 
-    // oxlint-disable-next-line prefer-await-to-then, no-void -- .then() needed inside Promise constructor; void discards unhandled rejection
-    void fn().then(
-      // oxlint-disable-next-line prefer-await-to-callbacks -- callback required inside .then()
-      (result) => {
+    const run = async () => {
+      try {
+        const result = await fn();
         if (settled) {
           return;
         }
@@ -215,9 +214,7 @@ export const withTimeout = <T>(
         signal?.removeEventListener('abort', onAbort);
         // oxlint-disable-next-line promise/no-multiple-resolved -- settled guard ensures single resolution
         resolve(result);
-      },
-      // oxlint-disable-next-line prefer-await-to-callbacks -- rejection handler required inside .then()
-      (error: unknown) => {
+      } catch (error: unknown) {
         if (settled) {
           return;
         }
@@ -229,6 +226,9 @@ export const withTimeout = <T>(
           Result.err(error instanceof Error ? error : new Error(String(error)))
         );
       }
-    );
+    };
+
+    // oxlint-disable-next-line no-void -- fire-and-settle inside Promise constructor
+    void run();
   });
 };