@superblocksteam/telemetry 2.0.0-SNAPSHOT.329be19cb7ca892b

package/dist-esm/common/log-sanitizer.js

@@ -0,0 +1,672 @@
+/**
+ * Log Sanitizer for Application-Level Secret Protection
+ *
+ * Sanitizes secrets from log messages while preserving debugging information.
+ * This operates at the APPLICATION layer and removes values that should NEVER
+ * appear in any log, anywhere.
+ *
+ * ARCHITECTURE:
+ * - Application layer (this file): secret sanitization only (unconditional, all deployments)
+ * - Policy layer (DEFAULT_SENSITIVE_PATTERNS / export path): PII redaction (deployment-specific;
+ *   cloud-prem redacts emails, cloud does not)
+ * - Pipeline layer (OTel Collector): Tier-based filtering for export
+ *
+ * Stack traces and file paths are preserved for debugging. The pipeline layer
+ * handles additional tier-based redaction for exported logs.
+ *
+ * @see https://github.com/superblocksteam/engineering/blob/main/projects/o11y-refactor/epics/epic-c4-logging-strategy.md
+ */
+// ============================================================================
+// Secret Patterns - These should NEVER appear in any log
+// ============================================================================
+/**
+ * Patterns that indicate tokens, keys, and secrets in log messages.
+ * These use capture groups to preserve prefixes while redacting values.
+ * Exported as DEFAULT_SECRET_PATTERNS for use in LoggingPolicyConfig (e.g. cloud-prem).
+ */
+export const DEFAULT_SECRET_PATTERNS = [
+    // Tokens and keys with prefixes
+    {
+        pattern: /(\bbearer\s+)[a-zA-Z0-9\-._~+/]+=*/gi,
+        replacement: "$1[REDACTED]",
+    },
+    { pattern: /(\bbasic\s+)\S+/gi, replacement: "$1[REDACTED]" },
+    { pattern: /(\bjwt\s+)[a-zA-Z0-9\-._~+/]+=*/gi, replacement: "$1[REDACTED]" },
+    {
+        pattern: /(\btoken[:\s=]+)[a-zA-Z0-9\-._~+/]{16,}=*/gi,
+        replacement: "$1[REDACTED]",
+    },
+    {
+        pattern: /(\bapi[_\s]?key[:\s=]+)[a-zA-Z0-9\-._~+/]{16,}=*/gi,
+        replacement: "$1[REDACTED]",
+    },
+    {
+        pattern: /(\baccess[_\s]?token[:\s=]+)[a-zA-Z0-9\-._~+/]{16,}=*/gi,
+        replacement: "$1[REDACTED]",
+    },
+    {
+        pattern: /(\brefresh[_\s]?token[:\s=]+)[a-zA-Z0-9\-._~+/]{16,}=*/gi,
+        replacement: "$1[REDACTED]",
+    },
+    // JWT pattern (base64.base64.base64) - standalone tokens
+    {
+        pattern: /\b[A-Za-z0-9-_]{20,}\.[A-Za-z0-9-_]{20,}\.[A-Za-z0-9-_]{20,}\b/g,
+        replacement: "[JWT_REDACTED]",
+    },
+    // OpenAI API keys
+    { pattern: /\bsk-[A-Za-z0-9]{48}\b/g, replacement: "[OPENAI_KEY_REDACTED]" },
+    // Anthropic API keys
+    {
+        pattern: /\bsk-ant-[A-Za-z0-9-]{32,}\b/g,
+        replacement: "[ANTHROPIC_KEY_REDACTED]",
+    },
+    // AWS access key IDs
+    { pattern: /\bAKIA[A-Z0-9]{16}\b/g, replacement: "[AWS_KEY_REDACTED]" },
+    // GitHub tokens
+    {
+        pattern: /\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g,
+        replacement: "[GITHUB_TOKEN_REDACTED]",
+    },
+    // Generic API key patterns
+    {
+        pattern: /\b(sk|pk)-[a-zA-Z0-9]{32,}\b/g,
+        replacement: "[API_KEY_REDACTED]",
+    },
+    // Connection strings with credentials
+    {
+        pattern: /\b(postgres|mysql|mongodb|redis):\/\/[^\s]+:[^\s]+@[^\s]+/gi,
+        replacement: "[CONNECTION_STRING_REDACTED]",
+    },
+    // PEM blocks
+    {
+        pattern: /-----BEGIN\s+(RSA\s+)?(PRIVATE|PUBLIC)\s+KEY-----[\s\S]*?-----END\s+(RSA\s+)?(PRIVATE|PUBLIC)\s+KEY-----/g,
+        replacement: "[PEM_KEY_REDACTED]",
+    },
+];
+const DEFAULT_PII_PATTERNS = [
+    // Match email addresses; requires an alphabetic TLD to avoid false positives on @mentions and
+    // npm/pnpm version strings (e.g. package@1.2.3 has a numeric suffix, not a TLD)
+    {
+        pattern: /[\w.+-]+@(?:[\w-]+\.)+[a-zA-Z]{2,}/g,
+        replacement: "[EMAIL REDACTED]",
+    },
+];
+const PROMPT_PAYLOAD_LOG_PATTERNS = [
+    {
+        pattern: /^(\[llm-generating\] (?:System prompt|User message):)\s*[\s\S]*$/g,
+        replacement: "$1 [REDACTED]",
+    },
+];
+// ============================================================================
+// Secret Fields - Field names that contain secrets
+// ============================================================================
+/**
+ * Fields that contain secrets and should be stripped from log objects.
+ * Only includes actual secret field names - NOT debugging info.
+ *
+ * Pipeline-layer concerns (AI content, stack traces, PII) are NOT included here.
+ * Those are handled by the OTel Collector for tier-based export filtering.
+ */
+export const SECRET_FIELDS = new Set([
+    // Auth/secrets
+    "password",
+    "passwd",
+    "secret",
+    "private_key",
+    "privatekey",
+    "credentials",
+    "token",
+    "accesstoken",
+    "access_token",
+    "refreshtoken",
+    "refresh_token",
+    "jwt",
+    "bearer",
+    "apikey",
+    "api_key",
+    "auth_token",
+    "authorization",
+    "cookie",
+    "x-api-key",
+]);
+/**
+ * Patterns for compound field names that contain secrets.
+ * Uses word boundary matching to avoid false positives.
+ * Exported for use in LoggingPolicyConfig (e.g. cloud-prem).
+ */
+export const SECRET_FIELD_PATTERNS = [
+    // Password patterns
+    /(?:^|[._-])password(?:[._-]|$)/i,
+    /(?:^|[._-])passwd(?:[._-]|$)/i,
+    // Secret patterns
+    /(?:^|[._-])secret(?:[._-]|$)/i,
+    /(?:^|[._-])private[._-]?key(?:[._-]|$)/i,
+    // Token patterns
+    /(?:^|[._-])token(?:[._-]|$)/i,
+    /(?:^|[._-])jwt(?:[._-]|$)/i,
+    /(?:^|[._-])bearer(?:[._-]|$)/i,
+    // Credential patterns
+    /(?:^|[._-])credentials?(?:[._-]|$)/i,
+    // API key patterns
+    /api[._-]?key/i,
+    /x[._-]api[._-]key/i,
+    // Auth token patterns
+    /auth[._-]token/i,
+];
+/**
+ * Check if a field name contains secrets using word boundary matching.
+ */
+export function isSecretField(fieldName) {
+    return isSecretFieldFromPolicy(fieldName, SECRET_FIELDS, SECRET_FIELD_PATTERNS);
+}
+/**
+ * Policy-driven secret field check. When names and patterns are empty, returns false.
+ * Used by PolicyAwareLogProcessor so cloud can pass empty set/array for no redaction.
+ */
+export function isSecretFieldFromPolicy(fieldName, secretFieldNames, secretFieldPatterns) {
+    if (secretFieldNames.size === 0 && secretFieldPatterns.length === 0) {
+        return false;
+    }
+    const lowerKey = fieldName.toLowerCase();
+    if (secretFieldNames.has(lowerKey)) {
+        return true;
+    }
+    return secretFieldPatterns.some((pattern) => pattern.test(lowerKey));
+}
+// ============================================================================
+// Export-forbidden fields (Tier 1 content - must not appear in exported logs)
+// ============================================================================
+/**
+ * Placeholder string used when redacting forbidden or secret fields in logs.
+ * Use this constant so all packages (server, telemetry) share one value.
+ */
+export const REDACTED_PLACEHOLDER = "[REDACTED]";
+/**
+ * Field names that must never be included in exported logs (stack, prompt, code, etc.).
+ * Used as the base for both cloud and cloud-prem.
+ */
+export const BASE_EXPORT_FORBIDDEN_FIELDS = new Set([
+    "code",
+    "error.stack",
+    "exception.stacktrace",
+    "filecontent",
+    "filepath",
+    "prompt",
+    "stack",
+]);
+/** Email-related keys forbidden in cloud-prem export only (allowed in cloud). */
+const EXPORT_FORBIDDEN_EMAIL_KEYS = new Set([
+    "user.email",
+    "user-email", // server req.logTags key (OBS_TAG_USER_EMAIL) for child logger bindings
+]);
+/** Export-forbidden fields for cloud (base only; email keys allowed). */
+export const EXPORT_FORBIDDEN_FIELDS_CLOUD = new Set(BASE_EXPORT_FORBIDDEN_FIELDS);
+/** Export-forbidden fields for cloud-prem (base + email keys). */
+export const EXPORT_FORBIDDEN_FIELDS_CLOUD_PREM = new Set([
+    ...BASE_EXPORT_FORBIDDEN_FIELDS,
+    ...EXPORT_FORBIDDEN_EMAIL_KEYS,
+]);
+/**
+ * Attribute keys that conventionally hold stack traces (epic C4). Value-based
+ * sanitization (containsStackTrace) redacts stack content in any key.
+ */
+const STACK_ATTRIBUTE_KEYS = new Set([
+    "error.stack",
+    "exception.stacktrace",
+    "stack",
+]);
+export function isStackAttributeKey(key) {
+    return STACK_ATTRIBUTE_KEYS.has(key.toLowerCase());
+}
+/**
+ * Check if a string contains a stack trace (for export redaction).
+ */
+export function containsStackTrace(text) {
+    if (!text || typeof text !== "string")
+        return false;
+    if (/at .{1,4096}?\(.{1,4096}?:\d+:\d+\)/.test(text))
+        return true;
+    if (/goroutine \d+ \[[^\]]{1,4096}\]:/.test(text))
+        return true;
+    if (/File "[^"]{1,4096}", line \d+/.test(text))
+        return true;
+    if (/at \w+\.\w+\([^()]{1,4096}\.java:\d+\)/.test(text))
+        return true;
+    return false;
+}
+/** Placeholder for stack trace redaction in exported logs. Exported for use in log-processor. */
+export const STACK_TRACE_REDACTED_PLACEHOLDER = "[STACK TRACE REDACTED - Tier 1 only]";
+/**
+ * Apply redact patterns to a string with a single replacement (resets lastIndex on each pattern).
+ */
+export function applyRedactPatterns(str, patterns, replacement = REDACTED_PLACEHOLDER) {
+    if (!str || typeof str !== "string")
+        return str;
+    let out = str;
+    for (const pattern of patterns) {
+        pattern.lastIndex = 0;
+        out = out.replace(pattern, replacement);
+    }
+    return out;
+}
+/**
+ * File extensions whose paths are redacted on the export path. Covers front-end
+ * source/build artifacts so customer file paths in bundler output are redacted.
+ * Declaration order here does NOT matter — the alternation is sorted
+ * longest-first at construction (below).
+ */
+const PATH_REDACTION_EXTENSIONS = [
+    "tsx",
+    "jsx",
+    "json",
+    "mjs",
+    "cjs",
+    "html",
+    "css",
+    "scss",
+    "ts",
+    "js",
+    "go",
+    "py",
+    "java",
+    "sql",
+];
+// Sort longest-first so overlapping suffixes always match fully (e.g. `.tsx`
+// before `.ts`, `.json` before `.js`) instead of leaving a dangling fragment
+// like `[PATH REDACTED]x`. A prefix is always strictly shorter than the string
+// it prefixes, so length-descending order makes the invariant self-enforcing —
+// adding a new extension can never break it regardless of where it's inserted.
+const PATH_REDACTION_ALTERNATION = [...PATH_REDACTION_EXTENSIONS]
+    .sort((a, b) => b.length - a.length)
+    .join("|");
+/** Sensitive patterns for cloud: path only (emails are not redacted in cloud). */
+export const SENSITIVE_PATTERNS_CLOUD = [
+    {
+        // Trailing \b stops a partial match like `.jsonl`/`.json5` from matching
+        // `.json` and leaving a dangling fragment (`[PATH REDACTED]l`); such paths
+        // are left untouched instead.
+        pattern: new RegExp(`/[\\w\\-./]+\\.(${PATH_REDACTION_ALTERNATION})\\b`, "gi"),
+        replacement: "[PATH REDACTED]",
+    },
+];
+/** Default sensitive patterns (path, email) for cloud-prem and when export is strict. */
+export const DEFAULT_SENSITIVE_PATTERNS = [
+    ...SENSITIVE_PATTERNS_CLOUD,
+    ...DEFAULT_PII_PATTERNS,
+];
+/**
+ * Regex patterns for cloud-prem log export: matched content is replaced with [REDACTED].
+ * Used as redactPatterns in LoggingPolicyConfig when deploymentType is CLOUD_PREM.
+ */
+export const CLOUD_PREM_REDACT_PATTERNS = [
+    // JWT pattern (base64.base64.base64) - standalone tokens
+    /\b[A-Za-z0-9-_]{20,}\.[A-Za-z0-9-_]{20,}\.[A-Za-z0-9-_]{20,}\b/g,
+    // Bearer tokens
+    /\bbearer\s+[a-zA-Z0-9\-._~+/]+=*/gi,
+    // API keys
+    /\bapi[_\s]?key[:\s=]+[a-zA-Z0-9\-._~+/]{16,}=*/gi,
+];
+/**
+ * Apply sensitive patterns (pattern + replacement) to text.
+ * Used with policy.sensitivePatterns whenever redacting values for export.
+ */
+export function redactSensitivePatterns(text, patterns) {
+    if (!text || typeof text !== "string")
+        return text;
+    let out = text;
+    for (const { pattern, replacement } of patterns) {
+        pattern.lastIndex = 0;
+        out = out.replace(pattern, replacement);
+    }
+    return out;
+}
+/**
+ * Redact stack trace for export: keep first line (error message) after sanitizing
+ * it with sensitive patterns, replace the rest with a placeholder.
+ * Use when exporting logs so stack traces never leave the environment.
+ *
+ * @param messageSecretPatterns - When non-empty, applied to first line before sensitivePatterns (policy-driven). When empty, uses sanitizeLogMessage for first line.
+ */
+export function redactStackTraceForExport(text, sensitivePatterns = [], messageSecretPatterns = []) {
+    if (!text || typeof text !== "string")
+        return text;
+    if (!containsStackTrace(text))
+        return text;
+    const lines = text.split("\n");
+    if (lines.length <= 1)
+        return text;
+    const firstLineRaw = messageSecretPatterns.length > 0
+        ? redactSensitivePatterns(lines[0], messageSecretPatterns)
+        : sanitizeLogMessage(lines[0]);
+    const firstLine = redactSensitivePatterns(firstLineRaw, sensitivePatterns);
+    return firstLine + "\n" + STACK_TRACE_REDACTED_PLACEHOLDER;
+}
+/**
+ * Sanitize a log message string for export: sensitive patterns, then policy redact patterns, then
+ * stack trace redaction. Use for the message argument in log calls (e.g. safe logger stdout path).
+ */
+export function sanitizeLogMessageForExport(message, redactPatterns, sensitivePatterns) {
+    if (!message || typeof message !== "string")
+        return message;
+    let out = redactSensitivePatterns(sanitizeLogMessage(message), sensitivePatterns);
+    out = applyRedactPatterns(out, redactPatterns);
+    if (containsStackTrace(out)) {
+        return redactStackTraceForExport(sanitizeLogMessage(out), sensitivePatterns);
+    }
+    return out;
+}
+/**
+ * Apply value-based sanitization to a string (sensitive patterns, policy redact patterns, then stack).
+ * Used by sanitizeLogRecordForExport for string values.
+ */
+function sanitizeStringValueForExport(value, key, redactPatterns, sensitivePatterns) {
+    let out = redactSensitivePatterns(sanitizeLogMessage(value), sensitivePatterns);
+    out = applyRedactPatterns(out, redactPatterns);
+    if (isStackAttributeKey(key)) {
+        return containsStackTrace(out)
+            ? redactStackTraceForExport(sanitizeLogMessage(out), sensitivePatterns)
+            : STACK_TRACE_REDACTED_PLACEHOLDER;
+    }
+    if (containsStackTrace(out)) {
+        return redactStackTraceForExport(sanitizeLogMessage(out), sensitivePatterns);
+    }
+    return out;
+}
+// ============================================================================
+// Legacy exports for backward compatibility
+// ============================================================================
+/**
+ * @deprecated Use SECRET_FIELDS instead. This export is kept for backward
+ * compatibility but now only contains secret fields, not Tier 1 content fields.
+ */
+export const TIER1_FORBIDDEN_LOG_FIELDS = SECRET_FIELDS;
+// ============================================================================
+// Public API
+// ============================================================================
+/**
+ * Sanitizes secrets from a log message string.
+ * Preserves debugging info (emails, file paths, stack traces, etc.) for troubleshooting.
+ * Email redaction is deployment-specific and handled via DEFAULT_SENSITIVE_PATTERNS
+ * on the export path (cloud-prem only).
+ *
+ * @param message - The log message to sanitize
+ * @returns Message with secrets redacted
+ */
+export function sanitizeLogMessage(message) {
+    if (!message || typeof message !== "string") {
+        return message;
+    }
+    let sanitized = message;
+    for (const { pattern, replacement } of [
+        ...PROMPT_PAYLOAD_LOG_PATTERNS,
+        ...DEFAULT_SECRET_PATTERNS,
+    ]) {
+        pattern.lastIndex = 0; // Reset regex state for global patterns
+        sanitized = sanitized.replace(pattern, replacement);
+    }
+    return sanitized;
+}
+/**
+ * Sanitizes secrets within a stack trace while preserving the full trace.
+ * Stack traces are essential for debugging - only redact secrets within them.
+ *
+ * @param stack - The stack trace string
+ * @returns Stack trace with secrets redacted but structure preserved
+ */
+export function redactStackTrace(stack) {
+    if (!stack || typeof stack !== "string") {
+        return stack;
+    }
+    // Preserve full stack trace, only sanitize secrets within
+    return sanitizeLogMessage(stack);
+}
+/**
+ * Recursively sanitizes secrets and high-risk PII from an object.
+ * Strips secret fields entirely, sanitizes string values.
+ * Preserves low-risk debugging info (stack traces, file paths).
+ *
+ * @param obj - The object to sanitize
+ * @param depth - Current recursion depth (default: 0)
+ * @returns Object with secrets removed
+ */
+export function sanitizeLogObject(obj, depth = 0) {
+    // Prevent infinite recursion
+    if (depth > 10) {
+        return "[MAX_DEPTH_REACHED]";
+    }
+    if (obj === null || obj === undefined) {
+        return obj;
+    }
+    if (typeof obj === "string") {
+        return sanitizeLogMessage(obj);
+    }
+    if (typeof obj === "number" || typeof obj === "boolean") {
+        return obj;
+    }
+    if (typeof obj !== "object") {
+        return obj;
+    }
+    if (Array.isArray(obj)) {
+        return obj.map((item) => sanitizeLogObject(item, depth + 1));
+    }
+    const sanitized = {};
+    for (const [key, value] of Object.entries(obj)) {
+        // Skip secret fields entirely
+        if (isSecretField(key)) {
+            continue;
+        }
+        // Recursively sanitize all other fields
+        sanitized[key] = sanitizeLogObject(value, depth + 1);
+    }
+    return sanitized;
+}
+/**
+ * Sanitize an object for export: exclude forbidden keys (omitted), redact secret keys (key kept, value [REDACTED]),
+ * and apply sensitive patterns to string values. Used by PolicyAwareLogProcessor when exporting log body objects.
+ */
+export function sanitizeLogObjectForExport(obj, forbiddenFields, depth = 0, sensitivePatterns = []) {
+    if (depth > 10) {
+        return "[MAX_DEPTH_REACHED]";
+    }
+    if (obj === null || obj === undefined) {
+        return obj;
+    }
+    if (typeof obj === "string") {
+        return redactSensitivePatterns(sanitizeLogMessage(obj), sensitivePatterns);
+    }
+    if (typeof obj === "number" || typeof obj === "boolean") {
+        return obj;
+    }
+    if (typeof obj !== "object") {
+        return obj;
+    }
+    if (Array.isArray(obj)) {
+        return obj.map((item) => sanitizeLogObjectForExport(item, forbiddenFields, depth + 1, sensitivePatterns));
+    }
+    const result = {};
+    for (const [key, value] of Object.entries(obj)) {
+        const lowerKey = key.toLowerCase();
+        // Secret fields: keep key, redact value (consistent with sanitizeAttributes)
+        if (isSecretField(key)) {
+            result[key] = REDACTED_PLACEHOLDER;
+            continue;
+        }
+        // Forbidden fields (e.g. prompt, code, stack): exclude from export (omit key and value).
+        if (forbiddenFields.has(lowerKey)) {
+            continue;
+        }
+        // String values: redact stack traces by key or content, then sensitive patterns
+        if (typeof value === "string") {
+            if (isStackAttributeKey(key)) {
+                result[key] = containsStackTrace(value)
+                    ? redactStackTraceForExport(sanitizeLogMessage(value), sensitivePatterns)
+                    : STACK_TRACE_REDACTED_PLACEHOLDER;
+            }
+            else if (containsStackTrace(value)) {
+                result[key] = redactStackTraceForExport(sanitizeLogMessage(value), sensitivePatterns);
+            }
+            else {
+                result[key] = redactSensitivePatterns(sanitizeLogMessage(value), sensitivePatterns);
+            }
+            continue;
+        }
+        result[key] = sanitizeLogObjectForExport(value, forbiddenFields, depth + 1, sensitivePatterns);
+    }
+    return result;
+}
+/**
+ * Sanitize a log record for export with both key-based and value-based redaction.
+ * Applies sensitivePatterns and redactPatterns to every string value.
+ * Use for the server stdout path (safe logger and RemoteLogger redactRecord) so exported logs match OTLP behavior.
+ */
+export function sanitizeLogRecordForExport(obj, forbiddenFields, redactPatterns, sensitivePatterns, depth = 0) {
+    if (depth > 10) {
+        return "[MAX_DEPTH_REACHED]";
+    }
+    if (obj === null || obj === undefined) {
+        return obj;
+    }
+    if (typeof obj === "string") {
+        return sanitizeLogMessageForExport(obj, redactPatterns, sensitivePatterns);
+    }
+    if (typeof obj === "number" || typeof obj === "boolean") {
+        return obj;
+    }
+    if (typeof obj !== "object") {
+        return obj;
+    }
+    // Error instances have non-enumerable message/name/stack; convert so we can redact them.
+    if (obj instanceof Error) {
+        const plain = {
+            message: obj.message,
+            name: obj.name,
+            stack: obj.stack,
+        };
+        for (const key of Object.keys(obj)) {
+            if (!Object.prototype.hasOwnProperty.call(plain, key)) {
+                plain[key] = obj[key];
+            }
+        }
+        return sanitizeLogRecordForExport(plain, forbiddenFields, redactPatterns, sensitivePatterns, depth);
+    }
+    if (Array.isArray(obj)) {
+        return obj.map((item) => sanitizeLogRecordForExport(item, forbiddenFields, redactPatterns, sensitivePatterns, depth + 1));
+    }
+    const result = {};
+    for (const [key, value] of Object.entries(obj)) {
+        const lowerKey = key.toLowerCase();
+        if (isSecretField(key)) {
+            result[key] = REDACTED_PLACEHOLDER;
+            continue;
+        }
+        if (forbiddenFields.has(lowerKey)) {
+            continue;
+        }
+        if (typeof value === "string") {
+            result[key] = sanitizeStringValueForExport(value, key, redactPatterns, sensitivePatterns);
+            continue;
+        }
+        result[key] = sanitizeLogRecordForExport(value, forbiddenFields, redactPatterns, sensitivePatterns, depth + 1);
+    }
+    return result;
+}
+/**
+ * Sanitizes secrets from an error object.
+ * Preserves full stack traces for debugging.
+ *
+ * @param error - The error to sanitize
+ * @returns Error object with secrets redacted
+ */
+export function sanitizeLogError(error) {
+    if (!error) {
+        return error;
+    }
+    // Check if already sanitized
+    const errorWithSanitized = error;
+    if (errorWithSanitized._sanitized) {
+        return error;
+    }
+    if (error instanceof Error) {
+        const sanitized = {
+            name: error.name,
+            message: sanitizeLogMessage(error.message),
+            // Preserve full stack trace, only sanitize secrets within
+            stack: sanitizeLogMessage(error.stack || ""),
+            _sanitized: true,
+        };
+        // Copy and sanitize enumerable properties
+        for (const [key, value] of Object.entries(error)) {
+            if (key !== "name" && key !== "message" && key !== "stack") {
+                // Skip secret fields
+                if (isSecretField(key)) {
+                    continue;
+                }
+                sanitized[key] = sanitizeLogObject(value);
+            }
+        }
+        return sanitized;
+    }
+    // For non-Error objects, sanitize the entire object
+    const sanitized = sanitizeLogObject(error);
+    sanitized._sanitized = true;
+    return sanitized;
+}
+/**
+ * Safe JSON stringify with secret sanitization.
+ * Handles circular references and non-serializable types.
+ * Preserves debugging info (stack traces, file paths, emails).
+ *
+ * @param obj - Object to stringify
+ * @param space - Indentation (optional)
+ * @returns JSON string with secrets redacted
+ */
+export function safeJsonStringify(obj, space) {
+    if (obj === null || obj === undefined) {
+        return "{}";
+    }
+    if (typeof obj === "string") {
+        return sanitizeLogMessage(obj);
+    }
+    const seen = new WeakSet();
+    return JSON.stringify(obj, (key, value) => {
+        // Skip secret fields
+        if (key && isSecretField(key)) {
+            return undefined;
+        }
+        // Handle null/undefined
+        if (value === null || value === undefined) {
+            return value;
+        }
+        // Handle circular references
+        if (typeof value === "object") {
+            if (seen.has(value)) {
+                return "[Circular Reference]";
+            }
+            seen.add(value);
+            // Handle Error objects - preserve full stack trace
+            if (value instanceof Error) {
+                return {
+                    name: value.name,
+                    message: sanitizeLogMessage(value.message),
+                    stack: sanitizeLogMessage(value.stack || ""),
+                };
+            }
+        }
+        // Sanitize string values
+        if (typeof value === "string") {
+            return sanitizeLogMessage(value);
+        }
+        // Handle non-serializable types
+        if (typeof value === "function") {
+            return `[Function: ${value.name || "anonymous"}]`;
+        }
+        if (typeof value === "symbol") {
+            return `[Symbol: ${value.toString()}]`;
+        }
+        if (typeof value === "bigint") {
+            return `[BigInt: ${value.toString()}]`;
+        }
+        return value;
+    }, space);
+}
+//# sourceMappingURL=log-sanitizer.js.map