@venizia/ignis-helpers 0.1.1-0 → 0.1.1-2

package/dist/common/redact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/common/redact.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,QAAQ,eAAe,CAAC;AAErC;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GAAI,OAAO,OAAO,EAAE,sBAA4B,KAAG,OA+B5E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,KAAG,MAelD,CAAC"}
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/common/redact.ts"],"names":[],"mappings":"AAgCA,eAAO,MAAM,QAAQ,eAAe,CAAC;AAErC;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GAAI,OAAO,OAAO,EAAE,sBAA4B,KAAG,OAgD5E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,KAAG,MAelD,CAAC"}

package/dist/common/redact.js

@@ -10,9 +10,18 @@ const SECRET_KEY_PATTERN = new RegExp([
     '^(pass|password|passphrase|secret|token|apiKey|api_key|accessKey|access_key',
     '|secretKey|secret_key|privateKey|private_key|key|cert|ca|pfx|credentials',
     '|authorization|auth|jwtSecret|applicationSecret|connectionString)$',
+    // Vault wire spellings (snake_case). node-vault's AppRole login/response bodies carry these
+    // exact keys; `secret_id`/`role_id` are the AppRole credential pair and `client_token` is the
+    // minted session token. None are matched by the anchored options list above.
+    '|^(client_token|secret_id|role_id)$',
+    // Any `*_token` (snake_case) or `*Token` (camelCase) key - access_token, refresh_token,
+    // vaultToken, ... A preceding character is required so the bare word `token` (already covered
+    // above) is not the whole match, and so ordinary words are not swallowed.
+    '|_token$|[a-z0-9]token$',
     // HTTP HEADER spellings. A header set is logged on every outbound request, and its names are
-    // kebab-case and often `x-`-prefixed - none of which the camelCase list above matches.
-    '|^(x-)?(api|auth|access|secret|session|csrf|xsrf)-(key|token|secret|id)$',
+    // kebab-case and often `x-`-prefixed - none of which the camelCase list above matches. `vault`
+    // is included so `X-Vault-Token` (node-vault's auth header) is caught.
+    '|^(x-)?(api|auth|access|secret|session|csrf|xsrf|vault)-(key|token|secret|id)$',
     '|^(cookie|set-cookie|proxy-authorization|www-authenticate)$',
 ].join(''), 'i');
 exports.REDACTED = '[REDACTED]';
@@ -32,6 +41,22 @@ const redactSecrets = (value, seen = new WeakSet()) => {
         return '[Circular]';
     }
     seen.add(value);
+    // An Error keeps `name`/`message`/`stack` as NON-enumerable, so `Object.keys()` skips them and a
+    // naive redaction would DROP the very message the log line is about. Reproject the error into a
+    // plain object that STILL carries those fields, plus its redacted enumerable own-props
+    // (`config`/`response`/... where a nested `X-Vault-Token` or `secret_id` becomes [REDACTED]).
+    if (value instanceof Error) {
+        const source = value;
+        const result = {
+            name: value.name,
+            message: value.message,
+            stack: value.stack,
+        };
+        for (const key of Object.keys(source)) {
+            result[key] = SECRET_KEY_PATTERN.test(key) ? exports.REDACTED : (0, exports.redactSecrets)(source[key], seen);
+        }
+        return result;
+    }
     if (Array.isArray(value)) {
         return value.map(entry => (0, exports.redactSecrets)(entry, seen));
     }

package/dist/common/redact.js.map

@@ -1 +1 @@
-{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/common/redact.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACH,MAAM,kBAAkB,GAAG,IAAI,MAAM,CACnC;IACE,qDAAqD;IACrD,6EAA6E;IAC7E,0EAA0E;IAC1E,oEAAoE;IAEpE,6FAA6F;IAC7F,uFAAuF;IACvF,0EAA0E;IAC1E,6DAA6D;CAC9D,CAAC,IAAI,CAAC,EAAE,CAAC,EACV,GAAG,CACJ,CAAC;AAEW,QAAA,QAAQ,GAAG,YAAY,CAAC;AAErC;;;;;;;GAOG;AACI,MAAM,aAAa,GAAG,CAAC,KAAc,EAAE,OAAO,IAAI,OAAO,EAAU,EAAW,EAAE;IACrF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEhB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAA,qBAAa,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QAC9D,OAAO,WAAY,KAAyB,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,KAAkB,CAAC;IAClC,MAAM,MAAM,GAAc,EAAE,CAAC;IAE7B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,CAAC,GAAG,gBAAQ,CAAC;YACvB,SAAS;QACX,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,IAAA,qBAAa,EAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AA/BW,QAAA,aAAa,iBA+BxB;AAEF;;;;;;;;GAQG;AACI,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAU,EAAE;IAC1D,IAAI,MAAW,CAAC;IAEhB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,CAAC,QAAQ,GAAG,gBAAQ,CAAC;IAC3B,OAAO,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC/C,CAAC,CAAC;AAfW,QAAA,oBAAoB,wBAe/B"}
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/common/redact.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACH,MAAM,kBAAkB,GAAG,IAAI,MAAM,CACnC;IACE,qDAAqD;IACrD,6EAA6E;IAC7E,0EAA0E;IAC1E,oEAAoE;IAEpE,4FAA4F;IAC5F,8FAA8F;IAC9F,6EAA6E;IAC7E,qCAAqC;IAErC,wFAAwF;IACxF,8FAA8F;IAC9F,0EAA0E;IAC1E,yBAAyB;IAEzB,6FAA6F;IAC7F,+FAA+F;IAC/F,uEAAuE;IACvE,gFAAgF;IAChF,6DAA6D;CAC9D,CAAC,IAAI,CAAC,EAAE,CAAC,EACV,GAAG,CACJ,CAAC;AAEW,QAAA,QAAQ,GAAG,YAAY,CAAC;AAErC;;;;;;;GAOG;AACI,MAAM,aAAa,GAAG,CAAC,KAAc,EAAE,OAAO,IAAI,OAAO,EAAU,EAAW,EAAE;IACrF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEhB,iGAAiG;IACjG,gGAAgG;IAChG,uFAAuF;IACvF,8FAA8F;IAC9F,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAA6B,CAAC;QAC7C,MAAM,MAAM,GAAc;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAQ,CAAC,CAAC,CAAC,IAAA,qBAAa,EAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAA,qBAAa,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QAC9D,OAAO,WAAY,KAAyB,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,KAAkB,CAAC;IAClC,MAAM,MAAM,GAAc,EAAE,CAAC;IAE7B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,CAAC,GAAG,gBAAQ,CAAC;YACvB,SAAS;QACX,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,IAAA,qBAAa,EAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAhDW,QAAA,aAAa,iBAgDxB;AAEF;;;;;;;;GAQG;AACI,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAU,EAAE;IAC1D,IAAI,MAAW,CAAC;IAEhB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,CAAC,QAAQ,GAAG,gBAAQ,CAAC;IAC3B,OAAO,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC/C,CAAC,CAAC;AAfW,QAAA,oBAAoB,wBAe/B"}

package/dist/modules/env/app-env.d.ts

@@ -35,9 +35,13 @@ export declare class ApplicationEnvironment implements IApplicationEnvironment {
         transform?: (value: BeforeTransformType) => ReturnType;
     }): ReturnType;
     set<ValueType>(key: string, value: ValueType): void;
+    merge(opts: {
+        envs: Record<string, string>;
+    }): void;
     isDevelopment(): boolean;
     keys(): string[];
 }
 export declare const applicationEnvironment: ApplicationEnvironment;
+export declare const AppEnvs: ApplicationEnvironment;
 export declare const Envs: ApplicationEnvironment;
 //# sourceMappingURL=app-env.d.ts.map

package/dist/modules/env/app-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-env.d.ts","sourceRoot":"","sources":["../../../src/modules/env/app-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAElD,qBAAa,WAAW;IACtB,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAEhC,MAAM,CAAC,QAAQ,CAAC,WAAW,iBAAiB;IAC5C,gGAAgG;IAChG,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,UAAU,gBAAgB;IAE1C,MAAM,CAAC,WAAW,cAWf;IAEH;;;;OAIG;IACH,MAAM,CAAC,gBAAgB,cAA2E;IAElG,MAAM,KAAK,OAAO,IAAI,MAAM,CAO3B;IAED,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE;CAGjC;AAED,qBAAa,sBAAuB,YAAW,uBAAuB;IACpE,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAA2B;gBAEhC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAA;KAAE;IAYvF,GAAG,CAAC,UAAU,EAAE,mBAAmB,GAAG,OAAO,EAC3C,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;QACL,YAAY,CAAC,EAAE,UAAU,CAAC;QAC1B,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,UAAU,CAAC;KACxD,GACA,UAAU;IAWb,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS;IAI5C,aAAa;IAKb,IAAI;CAGL;AAED,eAAO,MAAM,sBAAsB,wBAGjC,CAAC;AAEH,eAAO,MAAM,IAAI,wBAAyB,CAAC"}
+{"version":3,"file":"app-env.d.ts","sourceRoot":"","sources":["../../../src/modules/env/app-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAElD,qBAAa,WAAW;IACtB,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAEhC,MAAM,CAAC,QAAQ,CAAC,WAAW,iBAAiB;IAC5C,gGAAgG;IAChG,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,MAAM,CAAC,QAAQ,CAAC,UAAU,gBAAgB;IAE1C,MAAM,CAAC,WAAW,cAWf;IAEH;;;;OAIG;IACH,MAAM,CAAC,gBAAgB,cAA2E;IAElG,MAAM,KAAK,OAAO,IAAI,MAAM,CAO3B;IAED,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE;CAGjC;AAED,qBAAa,sBAAuB,YAAW,uBAAuB;IACpE,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAA2B;gBAEhC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAA;KAAE;IAYvF,GAAG,CAAC,UAAU,EAAE,mBAAmB,GAAG,OAAO,EAC3C,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;QACL,YAAY,CAAC,EAAE,UAAU,CAAC;QAC1B,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,UAAU,CAAC;KACxD,GACA,UAAU;IAWb,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS;IAI5C,KAAK,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;IAM5C,aAAa;IAKb,IAAI;CAGL;AAED,eAAO,MAAM,sBAAsB,wBAGjC,CAAC;AAEH,eAAO,MAAM,OAAO,wBAAyB,CAAC;AAC9C,eAAO,MAAM,IAAI,wBAAyB,CAAC"}

package/dist/modules/env/app-env.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Envs = exports.applicationEnvironment = exports.ApplicationEnvironment = exports.Environment = void 0;
+exports.Envs = exports.AppEnvs = exports.applicationEnvironment = exports.ApplicationEnvironment = exports.Environment = void 0;
 class Environment {
     static { this.LOCAL = 'local'; }
     static { this.DEBUG = 'debug'; }
@@ -65,6 +65,11 @@ class ApplicationEnvironment {
     set(key, value) {
         this.arguments[key] = value;
     }
+    merge(opts) {
+        for (const [key, value] of Object.entries(opts.envs)) {
+            this.arguments[key] = value;
+        }
+    }
     isDevelopment() {
         const { NODE_ENV } = process.env;
         return NODE_ENV === 'development';
@@ -78,5 +83,6 @@ exports.applicationEnvironment = new ApplicationEnvironment({
     prefix: process.env.APPLICATION_ENV_PREFIX ?? 'APP_ENV',
     envs: process.env,
 });
+exports.AppEnvs = exports.applicationEnvironment;
 exports.Envs = exports.applicationEnvironment;
 //# sourceMappingURL=app-env.js.map

package/dist/modules/env/app-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-env.js","sourceRoot":"","sources":["../../../src/modules/env/app-env.ts"],"names":[],"mappings":";;;AAEA,MAAa,WAAW;aACN,UAAK,GAAG,OAAO,CAAC;aAChB,UAAK,GAAG,OAAO,CAAC;aAEhB,gBAAW,GAAG,aAAa,CAAC;IAC5C,gGAAgG;aAChF,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,QAAG,GAAG,KAAK,CAAC;aACZ,UAAK,GAAG,OAAO,CAAC;aAChB,SAAI,GAAG,MAAM,CAAC;aACd,YAAO,GAAG,SAAS,CAAC;aAEpB,eAAU,GAAG,YAAY,CAAC;aAEnC,gBAAW,GAAG,IAAI,GAAG,CAAC;QAC3B,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,GAAG;QACR,IAAI,CAAC,GAAG;QACR,IAAI,CAAC,GAAG;QACR,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,UAAU;KAChB,CAAC,CAAC;IAEH;;;;OAIG;aACI,qBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAElG,MAAM,KAAK,OAAO;QAChB,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,WAAW,CAAC,WAAW,CAAC;QACjC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,EAAE,CAAC,IAAsB;QAC9B,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC;IACpC,CAAC;;AA/CH,kCAgDC;AAED,MAAa,sBAAsB;IAIjC,YAAY,IAA2E;QAF/E,cAAS,GAAwB,EAAE,CAAC;QAG1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE1B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,SAAS;YACX,CAAC;YAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,GAAG,CACD,GAAW,EACX,IAGC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAE/B,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,EAAE,IAAI,IAAI,EAAE,YAAY,CAAe,CAAC;QAClD,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,YAAY,CAAe,CAAC;IAC3D,CAAC;IAED,GAAG,CAAY,GAAW,EAAE,KAAgB;QAC1C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC9B,CAAC;IAED,aAAa;QACX,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;QACjC,OAAO,QAAQ,KAAK,aAAa,CAAC;IACpC,CAAC;IAED,IAAI;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;CACF;AA7CD,wDA6CC;AAEY,QAAA,sBAAsB,GAAG,IAAI,sBAAsB,CAAC;IAC/D,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,SAAS;IACvD,IAAI,EAAE,OAAO,CAAC,GAAG;CAClB,CAAC,CAAC;AAEU,QAAA,IAAI,GAAG,8BAAsB,CAAC"}
+{"version":3,"file":"app-env.js","sourceRoot":"","sources":["../../../src/modules/env/app-env.ts"],"names":[],"mappings":";;;AAEA,MAAa,WAAW;aACN,UAAK,GAAG,OAAO,CAAC;aAChB,UAAK,GAAG,OAAO,CAAC;aAEhB,gBAAW,GAAG,aAAa,CAAC;IAC5C,gGAAgG;aAChF,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,QAAG,GAAG,KAAK,CAAC;aACZ,UAAK,GAAG,OAAO,CAAC;aAChB,SAAI,GAAG,MAAM,CAAC;aACd,YAAO,GAAG,SAAS,CAAC;aAEpB,eAAU,GAAG,YAAY,CAAC;aAEnC,gBAAW,GAAG,IAAI,GAAG,CAAC;QAC3B,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,GAAG;QACR,IAAI,CAAC,GAAG;QACR,IAAI,CAAC,GAAG;QACR,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,UAAU;KAChB,CAAC,CAAC;IAEH;;;;OAIG;aACI,qBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAElG,MAAM,KAAK,OAAO;QAChB,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,WAAW,CAAC,WAAW,CAAC;QACjC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,EAAE,CAAC,IAAsB;QAC9B,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC;IACpC,CAAC;;AA/CH,kCAgDC;AAED,MAAa,sBAAsB;IAIjC,YAAY,IAA2E;QAF/E,cAAS,GAAwB,EAAE,CAAC;QAG1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE1B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,SAAS;YACX,CAAC;YAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,GAAG,CACD,GAAW,EACX,IAGC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAE/B,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,EAAE,IAAI,IAAI,EAAE,YAAY,CAAe,CAAC;QAClD,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,YAAY,CAAe,CAAC;IAC3D,CAAC;IAED,GAAG,CAAY,GAAW,EAAE,KAAgB;QAC1C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,IAAsC;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,aAAa;QACX,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;QACjC,OAAO,QAAQ,KAAK,aAAa,CAAC;IACpC,CAAC;IAED,IAAI;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;CACF;AAnDD,wDAmDC;AAEY,QAAA,sBAAsB,GAAG,IAAI,sBAAsB,CAAC;IAC/D,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,SAAS;IACvD,IAAI,EAAE,OAAO,CAAC,GAAG;CAClB,CAAC,CAAC;AAEU,QAAA,OAAO,GAAG,8BAAsB,CAAC;AACjC,QAAA,IAAI,GAAG,8BAAsB,CAAC"}

package/dist/modules/error/index.d.ts

@@ -1,4 +1,21 @@
-export * from './app-error';
-export * from './message-code';
+/**
+ * The error layer itself lives in `@venizia/ignis-inversion`, not here.
+ *
+ * It moved there so a browser application - which already depends on inversion for its DI, and
+ * cannot depend on helpers - raises and reads errors through the SAME class the server does.
+ * Before, inversion carried a second, divergent `ApplicationError` whose `messageCode` was never
+ * resolved. Backend code keeps importing from `@venizia/ignis-helpers` and sees no difference.
+ *
+ * Re-exported by name rather than `export *`: inversion's barrel also carries the DI container, and
+ * a blanket re-export would drag `Container`, `inject` and the rest into the helpers surface.
+ *
+ * Key registration works through this re-export: `declare module '@venizia/ignis-helpers'` merges
+ * into `IErrorKeyRegistry` exactly as augmenting inversion directly would, because merging follows
+ * the re-exported declaration. Augment whichever module the file already imports - TypeScript only
+ * treats `declare module` as an augmentation when the target is imported, and silently downgrades
+ * it to an inert ambient declaration otherwise. See `registry-augmentation.test.ts`.
+ */
+export { ApplicationError, ErrorScopes, getError, isApplicationError, MessageCode, } from '@venizia/ignis-inversion';
+export type { IErrorKeyRegistry, TError, TErrorByDefinition, TErrorByField, TErrorDefinition, TErrorDefinitionMessage, TErrorKey, TErrorMessage, TErrorMessageInput, TErrorMessageOverride, TErrorNormalized, TErrorNormalizeTransformFn, TErrorScope, TRegisterErrors, } from '@venizia/ignis-inversion';
 export * from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/modules/error/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/error/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/error/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,QAAQ,EACR,kBAAkB,EAClB,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,iBAAiB,EACjB,MAAM,EACN,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,uBAAuB,EACvB,SAAS,EACT,aAAa,EACb,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,0BAA0B,EAC1B,WAAW,EACX,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAElC,cAAc,SAAS,CAAC"}

package/dist/modules/error/index.js

@@ -14,7 +14,29 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./app-error"), exports);
-__exportStar(require("./message-code"), exports);
+exports.MessageCode = exports.isApplicationError = exports.getError = exports.ErrorScopes = exports.ApplicationError = void 0;
+/**
+ * The error layer itself lives in `@venizia/ignis-inversion`, not here.
+ *
+ * It moved there so a browser application - which already depends on inversion for its DI, and
+ * cannot depend on helpers - raises and reads errors through the SAME class the server does.
+ * Before, inversion carried a second, divergent `ApplicationError` whose `messageCode` was never
+ * resolved. Backend code keeps importing from `@venizia/ignis-helpers` and sees no difference.
+ *
+ * Re-exported by name rather than `export *`: inversion's barrel also carries the DI container, and
+ * a blanket re-export would drag `Container`, `inject` and the rest into the helpers surface.
+ *
+ * Key registration works through this re-export: `declare module '@venizia/ignis-helpers'` merges
+ * into `IErrorKeyRegistry` exactly as augmenting inversion directly would, because merging follows
+ * the re-exported declaration. Augment whichever module the file already imports - TypeScript only
+ * treats `declare module` as an augmentation when the target is imported, and silently downgrades
+ * it to an inert ambient declaration otherwise. See `registry-augmentation.test.ts`.
+ */
+var ignis_inversion_1 = require("@venizia/ignis-inversion");
+Object.defineProperty(exports, "ApplicationError", { enumerable: true, get: function () { return ignis_inversion_1.ApplicationError; } });
+Object.defineProperty(exports, "ErrorScopes", { enumerable: true, get: function () { return ignis_inversion_1.ErrorScopes; } });
+Object.defineProperty(exports, "getError", { enumerable: true, get: function () { return ignis_inversion_1.getError; } });
+Object.defineProperty(exports, "isApplicationError", { enumerable: true, get: function () { return ignis_inversion_1.isApplicationError; } });
+Object.defineProperty(exports, "MessageCode", { enumerable: true, get: function () { return ignis_inversion_1.MessageCode; } });
 __exportStar(require("./types"), exports);
 //# sourceMappingURL=index.js.map

package/dist/modules/error/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/error/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B;AAC5B,iDAA+B;AAC/B,0CAAwB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/error/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,4DAMkC;AALhC,mHAAA,gBAAgB,OAAA;AAChB,8GAAA,WAAW,OAAA;AACX,2GAAA,QAAQ,OAAA;AACR,qHAAA,kBAAkB,OAAA;AAClB,8GAAA,WAAW,OAAA;AAoBb,0CAAwB"}

package/dist/modules/error/types.d.ts

@@ -1,9 +1,24 @@
 import { z } from '@hono/zod-openapi';
+/**
+ * The error RESPONSE, for OpenAPI documentation - NOT the input to `getError`.
+ *
+ * The two used to be the same type, and that conflation is what let `getError` accept anything: the
+ * schema ended in `.catchall(z.any())` so the docs could describe `extra`, and the catchall then
+ * silently swallowed every mistyped field at every throw site. The input now lives in
+ * `@venizia/ignis-inversion` as a hand-written union with no index signature; this stays here
+ * because it needs `@hono/zod-openapi`, which inversion must not depend on - it ships to browsers.
+ */
 export declare const ErrorSchema: z.ZodObject<{
-    name: z.ZodOptional<z.ZodString>;
     statusCode: z.ZodOptional<z.ZodNumber>;
-    messageCode: z.ZodOptional<z.ZodString>;
     message: z.ZodString;
-}, z.core.$catchall<z.ZodAny>>;
-export type TError = z.infer<typeof ErrorSchema>;
+    normalized: z.ZodOptional<z.ZodObject<{
+        text: z.ZodString;
+        code: z.ZodString;
+        args: z.ZodRecord<z.ZodString, z.ZodAny>;
+    }, z.core.$strip>>;
+    extra: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    requestId: z.ZodOptional<z.ZodString>;
+    details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+}, z.core.$strip>;
+export type TErrorResponse = z.infer<typeof ErrorSchema>;
 //# sourceMappingURL=types.d.ts.map

package/dist/modules/error/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/modules/error/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAEtC,eAAO,MAAM,WAAW;;;;;8BAgBpB,CAAC;AAEL,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/modules/error/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAEtC;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;iBA6BpB,CAAC;AAEL,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/modules/error/types.js

@@ -2,21 +2,43 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ErrorSchema = void 0;
 const zod_openapi_1 = require("@hono/zod-openapi");
+/**
+ * The error RESPONSE, for OpenAPI documentation - NOT the input to `getError`.
+ *
+ * The two used to be the same type, and that conflation is what let `getError` accept anything: the
+ * schema ended in `.catchall(z.any())` so the docs could describe `extra`, and the catchall then
+ * silently swallowed every mistyped field at every throw site. The input now lives in
+ * `@venizia/ignis-inversion` as a hand-written union with no index signature; this stays here
+ * because it needs `@hono/zod-openapi`, which inversion must not depend on - it ships to browsers.
+ */
 exports.ErrorSchema = zod_openapi_1.z
     .object({
-    name: zod_openapi_1.z.string().optional(),
     statusCode: zod_openapi_1.z.number().optional(),
-    messageCode: zod_openapi_1.z.string().optional(),
     message: zod_openapi_1.z.string(),
+    normalized: zod_openapi_1.z
+        .object({
+        text: zod_openapi_1.z.string(),
+        code: zod_openapi_1.z.string(),
+        args: zod_openapi_1.z.record(zod_openapi_1.z.string(), zod_openapi_1.z.any()),
+    })
+        .optional(),
+    extra: zod_openapi_1.z.record(zod_openapi_1.z.string(), zod_openapi_1.z.any()).optional(),
+    requestId: zod_openapi_1.z.string().optional(),
+    details: zod_openapi_1.z.record(zod_openapi_1.z.string(), zod_openapi_1.z.any()).optional(),
 })
-    .catchall(zod_openapi_1.z.any())
     .openapi({
     description: 'Error Schema',
     example: {
-        name: 'ErrorName',
-        statusCode: '4xx | 5xx | ...',
-        messageCode: 'app.example.error_code',
-        message: 'Example Message',
+        statusCode: 409,
+        message: 'A category named %{name} already exists.',
+        normalized: {
+            text: 'A category named %{name} already exists.',
+            code: 'server.commerce.category.create.duplicate_name',
+            args: { name: 'Ticket' },
+        },
+        extra: { categoryId: 42 },
+        requestId: 'abc-123-def',
+        details: { url: 'http://localhost:3000/categories', path: '/categories' },
     },
 });
 //# sourceMappingURL=types.js.map

package/dist/modules/error/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/modules/error/types.ts"],"names":[],"mappings":";;;AAAA,mDAAsC;AAEzB,QAAA,WAAW,GAAG,eAAC;KACzB,MAAM,CAAC;IACN,IAAI,EAAE,eAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,eAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,eAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,eAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,QAAQ,CAAC,eAAC,CAAC,GAAG,EAAE,CAAC;KACjB,OAAO,CAAC;IACP,WAAW,EAAE,cAAc;IAC3B,OAAO,EAAE;QACP,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,wBAAwB;QACrC,OAAO,EAAE,iBAAiB;KAC3B;CACF,CAAC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/modules/error/types.ts"],"names":[],"mappings":";;;AAAA,mDAAsC;AAEtC;;;;;;;;GAQG;AACU,QAAA,WAAW,GAAG,eAAC;KACzB,MAAM,CAAC;IACN,UAAU,EAAE,eAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,OAAO,EAAE,eAAC,CAAC,MAAM,EAAE;IACnB,UAAU,EAAE,eAAC;SACV,MAAM,CAAC;QACN,IAAI,EAAE,eAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,eAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,eAAC,CAAC,MAAM,CAAC,eAAC,CAAC,MAAM,EAAE,EAAE,eAAC,CAAC,GAAG,EAAE,CAAC;KACpC,CAAC;SACD,QAAQ,EAAE;IACb,KAAK,EAAE,eAAC,CAAC,MAAM,CAAC,eAAC,CAAC,MAAM,EAAE,EAAE,eAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,eAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,eAAC,CAAC,MAAM,CAAC,eAAC,CAAC,MAAM,EAAE,EAAE,eAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,OAAO,CAAC;IACP,WAAW,EAAE,cAAc;IAC3B,OAAO,EAAE;QACP,UAAU,EAAE,GAAG;QACf,OAAO,EAAE,0CAA0C;QACnD,UAAU,EAAE;YACV,IAAI,EAAE,0CAA0C;YAChD,IAAI,EAAE,gDAAgD;YACtD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SACzB;QACD,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QACzB,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,EAAE,GAAG,EAAE,kCAAkC,EAAE,IAAI,EAAE,aAAa,EAAE;KAC1E;CACF,CAAC,CAAC"}

package/dist/modules/index.d.ts

@@ -7,6 +7,7 @@ export * from './network';
 export * from './pool';
 export * from './queue';
 export * from './redis';
+export * from './secrets';
 export * from './socket';
 export * from './storage';
 export * from './uid';

package/dist/modules/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/modules/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AAEvB,cAAc,UAAU,CAAC;AACzB,cAAc,OAAO,CAAC;AACtB,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC;AACxB,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,OAAO,CAAC;AACtB,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/modules/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AAEvB,cAAc,UAAU,CAAC;AACzB,cAAc,OAAO,CAAC;AACtB,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC;AACxB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,OAAO,CAAC;AACtB,cAAc,iBAAiB,CAAC"}

package/dist/modules/index.js

@@ -23,6 +23,7 @@ __exportStar(require("./network"), exports);
 __exportStar(require("./pool"), exports);
 __exportStar(require("./queue"), exports);
 __exportStar(require("./redis"), exports);
+__exportStar(require("./secrets"), exports);
 __exportStar(require("./socket"), exports);
 __exportStar(require("./storage"), exports);
 __exportStar(require("./uid"), exports);

package/dist/modules/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/modules/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yCAAuB;AAEvB,2CAAyB;AACzB,wCAAsB;AACtB,0CAAwB;AACxB,2CAAyB;AACzB,4CAA0B;AAC1B,yCAAuB;AACvB,0CAAwB;AACxB,0CAAwB;AACxB,2CAAyB;AACzB,4CAA0B;AAC1B,wCAAsB;AACtB,kDAAgC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/modules/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yCAAuB;AAEvB,2CAAyB;AACzB,wCAAsB;AACtB,0CAAwB;AACxB,2CAAyB;AACzB,4CAA0B;AAC1B,yCAAuB;AACvB,0CAAwB;AACxB,0CAAwB;AACxB,4CAA0B;AAC1B,2CAAyB;AACzB,4CAA0B;AAC1B,wCAAsB;AACtB,kDAAgC"}

package/dist/modules/logger/formatters/deep-splat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-splat.d.ts","sourceRoot":"","sources":["../../../../src/modules/logger/formatters/deep-splat.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,SAAS,CAAC;AAkD9B;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACrB,cAAc,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC;CACtC,KAAG,MAiBH,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,SAAS,4BASpB,CAAC"}
+{"version":3,"file":"deep-splat.d.ts","sourceRoot":"","sources":["../../../../src/modules/logger/formatters/deep-splat.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,OAAO,MAAM,SAAS,CAAC;AAmD9B;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACrB,cAAc,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC;CACtC,KAAG,MAqBH,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,SAAS,4BASpB,CAAC"}

package/dist/modules/logger/formatters/deep-splat.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.deepSplat = exports.formatLogMessage = void 0;
 const node_util_1 = __importDefault(require("node:util"));
 const winston_1 = __importDefault(require("winston"));
+const redact_1 = require("../../../common/redact");
 /** Winston stashes the extra arguments of `logger.error(msg, ...args)` under this well-known key. */
 const SPLAT = Symbol.for('splat');
 /** The placeholders `util.format` understands. `%%` is an escape, not a placeholder. */
@@ -63,7 +64,11 @@ const formatLogMessage = (opts) => {
         if (!isStringPlaceholder || !isInspectable) {
             return arg;
         }
-        return node_util_1.default.inspect(arg, inspectOptions);
+        // Redact before inspecting: any object deep-inspected into a log line (a node-vault AxiosError
+        // carrying a live `X-Vault-Token`, a driver payload with a password) is stripped of its secret
+        // KEYS here. `redactSecrets` copies non-secret fields through unchanged, so the diagnosis the
+        // line was opened for still renders at full depth.
+        return node_util_1.default.inspect((0, redact_1.redactSecrets)(arg), inspectOptions);
     });
     return node_util_1.default.formatWithOptions(inspectOptions, message, ...widened);
 };

package/dist/modules/logger/formatters/deep-splat.js.map

@@ -1 +1 @@
-{"version":3,"file":"deep-splat.js","sourceRoot":"","sources":["../../../../src/modules/logger/formatters/deep-splat.ts"],"names":[],"mappings":";;;;;;AAAA,0DAA6B;AAC7B,sDAA8B;AAG9B,qGAAqG;AACrG,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAElC,wFAAwF;AACxF,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,MAAM,YAAY,GAAG,GAAW,EAAE;IAChC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAE5D,+FAA+F;IAC/F,iCAAiC;IACjC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAE/C,mGAAmG;IACnG,kDAAkD;IAClD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,GAAwB,EAAE;IACpD,OAAO;QACL,KAAK,EAAE,YAAY,EAAE;QACrB,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,IAAI;QACrB,WAAW,EAAE,QAAQ;KACtB,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACI,MAAM,gBAAgB,GAAG,CAAC,IAIhC,EAAU,EAAE;IACX,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,GAAG,mBAAmB,EAAE,EAAE,GAAG,IAAI,CAAC;IAEvE,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IAEhG,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACtC,MAAM,mBAAmB,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;QACzD,MAAM,aAAa,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC;QAE9D,IAAI,CAAC,mBAAmB,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC;QACb,CAAC;QAED,OAAO,mBAAI,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,OAAO,mBAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;AACrE,CAAC,CAAC;AArBW,QAAA,gBAAgB,oBAqB3B;AAEF;;;GAGG;AACU,QAAA,SAAS,GAAG,iBAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;IAC7C,MAAM,IAAI,GAAI,IAAgB,CAAC,KAAK,CAA+B,CAAC;IAEpE,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,OAAO,GAAG,IAAA,wBAAgB,EAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC"}
+{"version":3,"file":"deep-splat.js","sourceRoot":"","sources":["../../../../src/modules/logger/formatters/deep-splat.ts"],"names":[],"mappings":";;;;;;AAAA,0DAA6B;AAC7B,sDAA8B;AAC9B,4CAAgD;AAGhD,qGAAqG;AACrG,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAElC,wFAAwF;AACxF,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,MAAM,YAAY,GAAG,GAAW,EAAE;IAChC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAE5D,+FAA+F;IAC/F,iCAAiC;IACjC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAE/C,mGAAmG;IACnG,kDAAkD;IAClD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,GAAwB,EAAE;IACpD,OAAO;QACL,KAAK,EAAE,YAAY,EAAE;QACrB,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,IAAI;QACrB,WAAW,EAAE,QAAQ;KACtB,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACI,MAAM,gBAAgB,GAAG,CAAC,IAIhC,EAAU,EAAE;IACX,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,GAAG,mBAAmB,EAAE,EAAE,GAAG,IAAI,CAAC;IAEvE,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IAEhG,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACtC,MAAM,mBAAmB,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;QACzD,MAAM,aAAa,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC;QAE9D,IAAI,CAAC,mBAAmB,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC;QACb,CAAC;QAED,+FAA+F;QAC/F,+FAA+F;QAC/F,8FAA8F;QAC9F,mDAAmD;QACnD,OAAO,mBAAI,CAAC,OAAO,CAAC,IAAA,sBAAa,EAAC,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,OAAO,mBAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;AACrE,CAAC,CAAC;AAzBW,QAAA,gBAAgB,oBAyB3B;AAEF;;;GAGG;AACU,QAAA,SAAS,GAAG,iBAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;IAC7C,MAAM,IAAI,GAAI,IAAgB,CAAC,KAAK,CAA+B,CAAC;IAEpE,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,OAAO,GAAG,IAAA,wBAAgB,EAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC"}

package/dist/modules/secrets/base/abstract.helper.d.ts

@@ -0,0 +1,64 @@
+import { BaseHelper } from '../../../modules/base';
+import type { IClock, IGetSecretOptions, ISecretLease, ISecretRotatable, ISecretsHelper, ISecretsHelperOptions, ITimerAdapter, TSecretRotationHandler } from '../common';
+interface IRawFetchResult {
+    value: Record<string, string>;
+    lease?: {
+        leaseId: string;
+        ttlSeconds: number;
+        renewable: boolean;
+    };
+}
+export declare abstract class AbstractSecretsHelper extends BaseHelper implements ISecretsHelper {
+    protected readonly clock: IClock;
+    protected readonly timers: ITimerAdapter;
+    protected readonly cacheTtlSeconds: number;
+    protected readonly renewBeforeRatio: number;
+    private readonly cache;
+    private readonly leases;
+    private readonly leasePaths;
+    private readonly timerHandles;
+    private readonly rotatables;
+    private readonly rotateHandlers;
+    private readonly backoffAttempts;
+    private closed;
+    constructor(opts: ISecretsHelperOptions);
+    protected abstract fetchRaw(opts: {
+        path: string;
+    }): Promise<IRawFetchResult>;
+    protected abstract renewRaw(opts: {
+        leaseId: string;
+        ttlSeconds: number;
+    }): Promise<{
+        ttlSeconds: number;
+    } | null>;
+    protected abstract revokeRaw(opts: {
+        leaseId: string;
+    }): Promise<void>;
+    configure(): Promise<void>;
+    getBundle(opts: {
+        path: string;
+    }): Promise<Record<string, string>>;
+    get(opts: IGetSecretOptions<string>): Promise<string>;
+    get<TValue>(opts: IGetSecretOptions<TValue>): Promise<TValue>;
+    lease(opts: {
+        path: string;
+        key: string;
+    }): Promise<ISecretLease>;
+    onRotate(handler: TSecretRotationHandler): void;
+    registerRotatable(opts: {
+        key: string;
+        target: ISecretRotatable;
+    }): void;
+    shutdown(): Promise<void>;
+    private writeCache;
+    private evictExpiredCache;
+    private clampDelayMs;
+    private armTimer;
+    private scheduleRenewal;
+    private scheduleBackoffRetry;
+    private handleRenewal;
+    private rotate;
+    private dispatchRotation;
+}
+export {};
+//# sourceMappingURL=abstract.helper.d.ts.map

package/dist/modules/secrets/base/abstract.helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abstract.helper.d.ts","sourceRoot":"","sources":["../../../../src/modules/secrets/base/abstract.helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,OAAO,KAAK,EACV,MAAM,EACN,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAEhB,cAAc,EACd,qBAAqB,EACrB,aAAa,EACb,sBAAsB,EAEvB,MAAM,WAAW,CAAC;AAOnB,UAAU,eAAe;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CACrE;AAuBD,8BAAsB,qBAAsB,SAAQ,UAAW,YAAW,cAAc;IACtF,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACjC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IACzC,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAC3C,SAAS,CAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAE5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkC;IACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyC;IACpE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgC;IAC/D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAC7D,OAAO,CAAC,MAAM,CAAS;gBAEX,IAAI,EAAE,qBAAqB;IAevC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC;IAC7E,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QAChC,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1C,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAGhE,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAI1B,SAAS,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAgBlE,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACrD,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAO7D,KAAK,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAsBvE,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI;IAI/C,iBAAiB,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,GAAG,IAAI;IAMlE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IA2B/B,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,QAAQ;IAehB,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,oBAAoB;YAWd,aAAa;YAwCb,MAAM;YAoBN,gBAAgB;CAkB/B"}