@reyaxyz/common 0.375.0 → 0.375.1

package/README.md

@@ -6,5 +6,5 @@
 
 | Statements                  | Branches                | Functions                 | Lines             |
 | --------------------------- | ----------------------- | ------------------------- | ----------------- |
-| ![Statements](https://img.shields.io/badge/statements-57.37%25-red.svg?style=flat) | ![Branches](https://img.shields.io/badge/branches-58.11%25-red.svg?style=flat) | ![Functions](https://img.shields.io/badge/functions-45.04%25-red.svg?style=flat) | ![Lines](https://img.shields.io/badge/lines-60.97%25-red.svg?style=flat) |
+| ![Statements](https://img.shields.io/badge/statements-58.3%25-red.svg?style=flat) | ![Branches](https://img.shields.io/badge/branches-58.8%25-red.svg?style=flat) | ![Functions](https://img.shields.io/badge/functions-45.93%25-red.svg?style=flat) | ![Lines](https://img.shields.io/badge/lines-61.84%25-red.svg?style=flat) |
 

package/dist/types/utils/index.d.ts

@@ -17,6 +17,7 @@ export * from './transaction-receipt';
 export * from './layerzero';
 export * from './throttled-error';
 export * from './error-sanitizer';
+export * from './url-secret-redaction';
 export * from './realized-balance';
 export * from './error-chain';
 export * from './receipt-rpc-error';

package/dist/types/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"/","sources":["utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC;AACpC,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"/","sources":["utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC;AACpC,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC"}

package/dist/types/utils/url-secret-redaction.d.ts

@@ -0,0 +1,15 @@
+export declare const REDACTED_URL_SECRET = "<redacted>";
+/**
+ * Masks credentials inside every URL in `text`: key-shaped path and query
+ * tokens, secret query parameters and userinfo. The scheme and host survive,
+ * so a redacted line still says which endpoint failed.
+ */
+export declare function redactUrlSecrets(text: string): string;
+/**
+ * Pure winston-format body for the end of a transport's chain, after `json()`.
+ * Redacting the serialized line covers every field (message, stack, a raw
+ * error's `info.requestUrl`, nested causes, `toJSON` output) whatever its name
+ * or depth, and runs only for lines that passed the transport's level gate.
+ */
+export declare function redactSerializedLogLine<T extends object>(info: T): T;
+//# sourceMappingURL=url-secret-redaction.d.ts.map

package/dist/types/utils/url-secret-redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-secret-redaction.d.ts","sourceRoot":"/","sources":["utils/url-secret-redaction.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,mBAAmB,eAAe,CAAC;AA0ChD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD;AAKD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAKpE"}

package/dist/utils/index.js

@@ -33,6 +33,7 @@ __exportStar(require("./transaction-receipt"), exports);
 __exportStar(require("./layerzero"), exports);
 __exportStar(require("./throttled-error"), exports);
 __exportStar(require("./error-sanitizer"), exports);
+__exportStar(require("./url-secret-redaction"), exports);
 __exportStar(require("./realized-balance"), exports);
 __exportStar(require("./error-chain"), exports);
 __exportStar(require("./receipt-rpc-error"), exports);

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"/","sources":["utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,2CAAyB;AACzB,8CAA4B;AAC5B,sDAAoC;AACpC,2CAAyB;AACzB,sDAAoC;AACpC,4CAA0B;AAC1B,2CAAyB;AACzB,0CAAwB;AACxB,8CAA4B;AAC5B,0CAAwB;AACxB,iDAA+B;AAC/B,wDAAsC;AACtC,8CAA4B;AAC5B,0CAAwB;AACxB,wDAAsC;AACtC,8CAA4B;AAC5B,oDAAkC;AAClC,oDAAkC;AAClC,qDAAmC;AACnC,gDAA8B;AAC9B,sDAAoC","sourcesContent":["export * from './consts';\nexport * from './points';\nexport * from './calculate';\nexport * from './compute-trade-pnl';\nexport * from './struct';\nexport * from './cooldown-interval';\nexport * from './network';\nexport * from './number';\nexport * from './retry';\nexport * from './timestamp';\nexport * from './token';\nexport * from './task-wrapper';\nexport * from './whitelisted-wallets';\nexport * from './stringify';\nexport * from './delay';\nexport * from './transaction-receipt';\nexport * from './layerzero';\nexport * from './throttled-error';\nexport * from './error-sanitizer';\nexport * from './realized-balance';\nexport * from './error-chain';\nexport * from './receipt-rpc-error';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"/","sources":["utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,2CAAyB;AACzB,8CAA4B;AAC5B,sDAAoC;AACpC,2CAAyB;AACzB,sDAAoC;AACpC,4CAA0B;AAC1B,2CAAyB;AACzB,0CAAwB;AACxB,8CAA4B;AAC5B,0CAAwB;AACxB,iDAA+B;AAC/B,wDAAsC;AACtC,8CAA4B;AAC5B,0CAAwB;AACxB,wDAAsC;AACtC,8CAA4B;AAC5B,oDAAkC;AAClC,oDAAkC;AAClC,yDAAuC;AACvC,qDAAmC;AACnC,gDAA8B;AAC9B,sDAAoC","sourcesContent":["export * from './consts';\nexport * from './points';\nexport * from './calculate';\nexport * from './compute-trade-pnl';\nexport * from './struct';\nexport * from './cooldown-interval';\nexport * from './network';\nexport * from './number';\nexport * from './retry';\nexport * from './timestamp';\nexport * from './token';\nexport * from './task-wrapper';\nexport * from './whitelisted-wallets';\nexport * from './stringify';\nexport * from './delay';\nexport * from './transaction-receipt';\nexport * from './layerzero';\nexport * from './throttled-error';\nexport * from './error-sanitizer';\nexport * from './url-secret-redaction';\nexport * from './realized-balance';\nexport * from './error-chain';\nexport * from './receipt-rpc-error';\n"]}

package/dist/utils/url-secret-redaction.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactSerializedLogLine = exports.redactUrlSecrets = exports.REDACTED_URL_SECRET = void 0;
+// RPC providers carry the API key in the URL path (Conduit, Alchemy, Infura,
+// Tenderly, ...), and ethers v6 embeds the full request URL in a SERVER_ERROR's
+// message, stack and `info.requestUrl`. Every logged RPC failure therefore
+// wrote the keyed endpoint, which Datadog then pasted into alert samples. URL
+// credentials are masked here, host-agnostically, so a new provider is covered
+// without a list to keep in sync.
+exports.REDACTED_URL_SECRET = '<redacted>';
+// A URL runs from its scheme to the first character that cannot appear
+// unescaped in one: whitespace, a quote, a backslash (JSON escaping inside a
+// serialized log line) or an angle bracket.
+var URL_IN_TEXT = /\b[a-z][a-z0-9+.-]*:\/\/[^\s"'`\\<>]+/gi;
+var AUTHORITY_END = /[/?#]/;
+// Provider keys are 22-40 characters. A run is matched wherever it sits in the
+// path or query, so `/bot<id>:<token>/` style segments are covered too.
+var LONG_TOKEN = /[A-Za-z0-9_-]{20,}/g;
+// Long runs that are identifiers rather than keys: 0x hashes and addresses,
+// UUIDs, single-case words and slugs, camelCase words and numbers. A random
+// key is practically never any of these: sampled, about 1 in 6,000 random
+// 22-character base62 keys, and none in 400,000 at 33 (Conduit's length).
+var IDENTIFIER = /^(?:0x[0-9a-fA-F]+|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}|[a-z_-]+|[A-Z_-]+|[a-z]*(?:[A-Z][a-z]+)+|[0-9_-]+)$/;
+// Secret-bearing query parameters whose values may be shorter than LONG_TOKEN.
+var SECRET_PARAM = /([?&;](?:api[-_]?key|key|token|access[-_]?token|auth|secret|client[-_]?secret|password|passwd|pwd|dkey|dd-api-key|x-api-key|signature|sig)=)[^&#;]*/gi;
+var redactUrl = function (url) {
+    var schemeEnd = url.indexOf('://') + 3;
+    var rest = url.slice(schemeEnd);
+    var authorityLength = rest.search(AUTHORITY_END);
+    var authority = authorityLength === -1 ? rest : rest.slice(0, authorityLength);
+    var tail = authorityLength === -1 ? '' : rest.slice(authorityLength);
+    // `user:pass@host`: the whole userinfo goes, since some providers put the
+    // key in the username.
+    var at = authority.lastIndexOf('@');
+    if (at !== -1)
+        authority = "".concat(exports.REDACTED_URL_SECRET, "@").concat(authority.slice(at + 1));
+    var redactedTail = tail
+        .replace(SECRET_PARAM, "$1".concat(exports.REDACTED_URL_SECRET))
+        .replace(LONG_TOKEN, function (token) {
+        return IDENTIFIER.test(token) ? token : exports.REDACTED_URL_SECRET;
+    });
+    return url.slice(0, schemeEnd) + authority + redactedTail;
+};
+/**
+ * Masks credentials inside every URL in `text`: key-shaped path and query
+ * tokens, secret query parameters and userinfo. The scheme and host survive,
+ * so a redacted line still says which endpoint failed.
+ */
+function redactUrlSecrets(text) {
+    if (!text.includes('://'))
+        return text;
+    return text.replace(URL_IN_TEXT, redactUrl);
+}
+exports.redactUrlSecrets = redactUrlSecrets;
+// triple-beam's MESSAGE: the serialized line a winston transport writes.
+var MESSAGE = Symbol.for('message');
+/**
+ * Pure winston-format body for the end of a transport's chain, after `json()`.
+ * Redacting the serialized line covers every field (message, stack, a raw
+ * error's `info.requestUrl`, nested causes, `toJSON` output) whatever its name
+ * or depth, and runs only for lines that passed the transport's level gate.
+ */
+function redactSerializedLogLine(info) {
+    var record = info;
+    var line = record[MESSAGE];
+    if (typeof line === 'string')
+        record[MESSAGE] = redactUrlSecrets(line);
+    return info;
+}
+exports.redactSerializedLogLine = redactSerializedLogLine;
+//# sourceMappingURL=url-secret-redaction.js.map

package/dist/utils/url-secret-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-secret-redaction.js","sourceRoot":"/","sources":["utils/url-secret-redaction.ts"],"names":[],"mappings":";;;AAAA,6EAA6E;AAC7E,gFAAgF;AAChF,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,kCAAkC;AACrB,QAAA,mBAAmB,GAAG,YAAY,CAAC;AAEhD,uEAAuE;AACvE,6EAA6E;AAC7E,4CAA4C;AAC5C,IAAM,WAAW,GAAG,yCAAyC,CAAC;AAC9D,IAAM,aAAa,GAAG,OAAO,CAAC;AAC9B,+EAA+E;AAC/E,wEAAwE;AACxE,IAAM,UAAU,GAAG,qBAAqB,CAAC;AACzC,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,0EAA0E;AAC1E,IAAM,UAAU,GACd,oJAAoJ,CAAC;AACvJ,+EAA+E;AAC/E,IAAM,YAAY,GAChB,uJAAuJ,CAAC;AAE1J,IAAM,SAAS,GAAG,UAAC,GAAW;IAC5B,IAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,IAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClC,IAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,SAAS,GACX,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IACjE,IAAM,IAAI,GAAG,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAEvE,0EAA0E;IAC1E,uBAAuB;IACvB,IAAM,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,EAAE,KAAK,CAAC,CAAC;QACX,SAAS,GAAG,UAAG,2BAAmB,cAAI,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC;IAElE,IAAM,YAAY,GAAG,IAAI;SACtB,OAAO,CAAC,YAAY,EAAE,YAAK,2BAAmB,CAAE,CAAC;SACjD,OAAO,CAAC,UAAU,EAAE,UAAC,KAAK;QACzB,OAAA,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,2BAAmB;IAApD,CAAoD,CACrD,CAAC;IACJ,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,SAAS,GAAG,YAAY,CAAC;AAC5D,CAAC,CAAC;AAEF;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAHD,4CAGC;AAED,yEAAyE;AACzE,IAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAEtC;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAmB,IAAO;IAC/D,IAAM,MAAM,GAAG,IAA+B,CAAC;IAC/C,IAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,CAAC,OAAO,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AALD,0DAKC","sourcesContent":["// RPC providers carry the API key in the URL path (Conduit, Alchemy, Infura,\n// Tenderly, ...), and ethers v6 embeds the full request URL in a SERVER_ERROR's\n// message, stack and `info.requestUrl`. Every logged RPC failure therefore\n// wrote the keyed endpoint, which Datadog then pasted into alert samples. URL\n// credentials are masked here, host-agnostically, so a new provider is covered\n// without a list to keep in sync.\nexport const REDACTED_URL_SECRET = '<redacted>';\n\n// A URL runs from its scheme to the first character that cannot appear\n// unescaped in one: whitespace, a quote, a backslash (JSON escaping inside a\n// serialized log line) or an angle bracket.\nconst URL_IN_TEXT = /\\b[a-z][a-z0-9+.-]*:\\/\\/[^\\s\"'`\\\\<>]+/gi;\nconst AUTHORITY_END = /[/?#]/;\n// Provider keys are 22-40 characters. A run is matched wherever it sits in the\n// path or query, so `/bot<id>:<token>/` style segments are covered too.\nconst LONG_TOKEN = /[A-Za-z0-9_-]{20,}/g;\n// Long runs that are identifiers rather than keys: 0x hashes and addresses,\n// UUIDs, single-case words and slugs, camelCase words and numbers. A random\n// key is practically never any of these: sampled, about 1 in 6,000 random\n// 22-character base62 keys, and none in 400,000 at 33 (Conduit's length).\nconst IDENTIFIER =\n  /^(?:0x[0-9a-fA-F]+|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}|[a-z_-]+|[A-Z_-]+|[a-z]*(?:[A-Z][a-z]+)+|[0-9_-]+)$/;\n// Secret-bearing query parameters whose values may be shorter than LONG_TOKEN.\nconst SECRET_PARAM =\n  /([?&;](?:api[-_]?key|key|token|access[-_]?token|auth|secret|client[-_]?secret|password|passwd|pwd|dkey|dd-api-key|x-api-key|signature|sig)=)[^&#;]*/gi;\n\nconst redactUrl = (url: string): string => {\n  const schemeEnd = url.indexOf('://') + 3;\n  const rest = url.slice(schemeEnd);\n  const authorityLength = rest.search(AUTHORITY_END);\n  let authority =\n    authorityLength === -1 ? rest : rest.slice(0, authorityLength);\n  const tail = authorityLength === -1 ? '' : rest.slice(authorityLength);\n\n  // `user:pass@host`: the whole userinfo goes, since some providers put the\n  // key in the username.\n  const at = authority.lastIndexOf('@');\n  if (at !== -1)\n    authority = `${REDACTED_URL_SECRET}@${authority.slice(at + 1)}`;\n\n  const redactedTail = tail\n    .replace(SECRET_PARAM, `$1${REDACTED_URL_SECRET}`)\n    .replace(LONG_TOKEN, (token) =>\n      IDENTIFIER.test(token) ? token : REDACTED_URL_SECRET,\n    );\n  return url.slice(0, schemeEnd) + authority + redactedTail;\n};\n\n/**\n * Masks credentials inside every URL in `text`: key-shaped path and query\n * tokens, secret query parameters and userinfo. The scheme and host survive,\n * so a redacted line still says which endpoint failed.\n */\nexport function redactUrlSecrets(text: string): string {\n  if (!text.includes('://')) return text;\n  return text.replace(URL_IN_TEXT, redactUrl);\n}\n\n// triple-beam's MESSAGE: the serialized line a winston transport writes.\nconst MESSAGE = Symbol.for('message');\n\n/**\n * Pure winston-format body for the end of a transport's chain, after `json()`.\n * Redacting the serialized line covers every field (message, stack, a raw\n * error's `info.requestUrl`, nested causes, `toJSON` output) whatever its name\n * or depth, and runs only for lines that passed the transport's level gate.\n */\nexport function redactSerializedLogLine<T extends object>(info: T): T {\n  const record = info as Record<symbol, unknown>;\n  const line = record[MESSAGE];\n  if (typeof line === 'string') record[MESSAGE] = redactUrlSecrets(line);\n  return info;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reyaxyz/common",
-  "version": "0.375.0",
+  "version": "0.375.1",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org"
@@ -41,5 +41,5 @@
     "test:coverage": "npx jest test --coverage",
     "generate:coverage-badges": "npx istanbul-badges-readme --silent"
   },
-  "gitHead": "a8533fadd939f92e45947d80028bdbc3d20bd8cb"
+  "gitHead": "791417881bf992324c38880a478e6cac391be7f9"
 }

package/src/utils/index.ts

@@ -17,6 +17,7 @@ export * from './transaction-receipt';
 export * from './layerzero';
 export * from './throttled-error';
 export * from './error-sanitizer';
+export * from './url-secret-redaction';
 export * from './realized-balance';
 export * from './error-chain';
 export * from './receipt-rpc-error';

package/src/utils/url-secret-redaction.ts

@@ -0,0 +1,73 @@
+// RPC providers carry the API key in the URL path (Conduit, Alchemy, Infura,
+// Tenderly, ...), and ethers v6 embeds the full request URL in a SERVER_ERROR's
+// message, stack and `info.requestUrl`. Every logged RPC failure therefore
+// wrote the keyed endpoint, which Datadog then pasted into alert samples. URL
+// credentials are masked here, host-agnostically, so a new provider is covered
+// without a list to keep in sync.
+export const REDACTED_URL_SECRET = '<redacted>';
+
+// A URL runs from its scheme to the first character that cannot appear
+// unescaped in one: whitespace, a quote, a backslash (JSON escaping inside a
+// serialized log line) or an angle bracket.
+const URL_IN_TEXT = /\b[a-z][a-z0-9+.-]*:\/\/[^\s"'`\\<>]+/gi;
+const AUTHORITY_END = /[/?#]/;
+// Provider keys are 22-40 characters. A run is matched wherever it sits in the
+// path or query, so `/bot<id>:<token>/` style segments are covered too.
+const LONG_TOKEN = /[A-Za-z0-9_-]{20,}/g;
+// Long runs that are identifiers rather than keys: 0x hashes and addresses,
+// UUIDs, single-case words and slugs, camelCase words and numbers. A random
+// key is practically never any of these: sampled, about 1 in 6,000 random
+// 22-character base62 keys, and none in 400,000 at 33 (Conduit's length).
+const IDENTIFIER =
+  /^(?:0x[0-9a-fA-F]+|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}|[a-z_-]+|[A-Z_-]+|[a-z]*(?:[A-Z][a-z]+)+|[0-9_-]+)$/;
+// Secret-bearing query parameters whose values may be shorter than LONG_TOKEN.
+const SECRET_PARAM =
+  /([?&;](?:api[-_]?key|key|token|access[-_]?token|auth|secret|client[-_]?secret|password|passwd|pwd|dkey|dd-api-key|x-api-key|signature|sig)=)[^&#;]*/gi;
+
+const redactUrl = (url: string): string => {
+  const schemeEnd = url.indexOf('://') + 3;
+  const rest = url.slice(schemeEnd);
+  const authorityLength = rest.search(AUTHORITY_END);
+  let authority =
+    authorityLength === -1 ? rest : rest.slice(0, authorityLength);
+  const tail = authorityLength === -1 ? '' : rest.slice(authorityLength);
+
+  // `user:pass@host`: the whole userinfo goes, since some providers put the
+  // key in the username.
+  const at = authority.lastIndexOf('@');
+  if (at !== -1)
+    authority = `${REDACTED_URL_SECRET}@${authority.slice(at + 1)}`;
+
+  const redactedTail = tail
+    .replace(SECRET_PARAM, `$1${REDACTED_URL_SECRET}`)
+    .replace(LONG_TOKEN, (token) =>
+      IDENTIFIER.test(token) ? token : REDACTED_URL_SECRET,
+    );
+  return url.slice(0, schemeEnd) + authority + redactedTail;
+};
+
+/**
+ * Masks credentials inside every URL in `text`: key-shaped path and query
+ * tokens, secret query parameters and userinfo. The scheme and host survive,
+ * so a redacted line still says which endpoint failed.
+ */
+export function redactUrlSecrets(text: string): string {
+  if (!text.includes('://')) return text;
+  return text.replace(URL_IN_TEXT, redactUrl);
+}
+
+// triple-beam's MESSAGE: the serialized line a winston transport writes.
+const MESSAGE = Symbol.for('message');
+
+/**
+ * Pure winston-format body for the end of a transport's chain, after `json()`.
+ * Redacting the serialized line covers every field (message, stack, a raw
+ * error's `info.requestUrl`, nested causes, `toJSON` output) whatever its name
+ * or depth, and runs only for lines that passed the transport's level gate.
+ */
+export function redactSerializedLogLine<T extends object>(info: T): T {
+  const record = info as Record<symbol, unknown>;
+  const line = record[MESSAGE];
+  if (typeof line === 'string') record[MESSAGE] = redactUrlSecrets(line);
+  return info;
+}