@veryfront/ext-content-mdx 0.1.1186 → 0.1.1189

package/esm/src/utils/logger/redact.js

@@ -9,19 +9,124 @@
  * credential before serialization, so an accidental
  * `logger.info("...", { authorization: token })` cannot leak the secret.
  *
- * Scope is intentionally key-based: we do not attempt to find secrets embedded
- * in free-form message strings (too lossy). The deny-list errs toward
- * over-redaction — masking a benign `tokenCount` is acceptable; leaking a real
- * token is not. The traversal fails *closed*: on a cycle, depth overflow, or a
- * throwing getter it returns {@link REDACTED} rather than risk emitting an
- * unredacted object.
+ * Sensitive keys are masked and every string value is scrubbed for credentials
+ * embedded in URL userinfo, query parameters, or fragment parameters. The
+ * deny-list errs toward over-redaction — masking a benign `tokenCount` is
+ * acceptable; leaking a real token is not. The traversal fails *closed*: on a
+ * cycle, depth overflow, or a throwing getter it returns {@link REDACTED}
+ * rather than risk emitting an unredacted object.
  */
-import { isRecord } from "./core.js";
 /** Replacement value substituted for any sensitive field. */
 export const REDACTED = "[REDACTED]";
+const apply = Reflect.apply;
+const NativeUint32Array = Uint32Array;
+const regExpExec = RegExp.prototype.exec;
+const regExpReplace = RegExp.prototype[Symbol.replace];
+const stringCharCodeAt = String.prototype.charCodeAt;
+const stringSlice = String.prototype.slice;
+const stringToLowerCase = String.prototype.toLowerCase;
+const NON_ALPHANUMERIC_PATTERN = /[^a-z0-9]/g;
 /** Strip all non-alphanumeric characters and lowercase, used for key normalization. */
 function normalizeToAlphanumeric(s) {
-    return s.toLowerCase().replace(/[^a-z0-9]/g, "");
+    const lowercase = apply(stringToLowerCase, s, []);
+    return apply(regExpReplace, NON_ALPHANUMERIC_PATTERN, [lowercase, ""]);
+}
+const FORWARD_SLASH_CODE_UNIT = 47;
+const BACKSLASH_CODE_UNIT = 92;
+const COLON_CODE_UNIT = 58;
+const ASCII_UPPERCASE_A_CODE_UNIT = 65;
+const ASCII_UPPERCASE_Z_CODE_UNIT = 90;
+const ASCII_LOWERCASE_OFFSET = 32;
+function stringCodeUnitAt(value, index) {
+    return apply(stringCharCodeAt, value, [index]);
+}
+function sliceString(value, start, end) {
+    return end === undefined
+        ? apply(stringSlice, value, [start])
+        : apply(stringSlice, value, [start, end]);
+}
+function isPathSeparatorCodeUnit(codeUnit) {
+    return codeUnit === FORWARD_SLASH_CODE_UNIT || codeUnit === BACKSLASH_CODE_UNIT;
+}
+function isAsciiLetterCodeUnit(codeUnit) {
+    const lowercase = codeUnit >= ASCII_UPPERCASE_A_CODE_UNIT &&
+        codeUnit <= ASCII_UPPERCASE_Z_CODE_UNIT
+        ? codeUnit + ASCII_LOWERCASE_OFFSET
+        : codeUnit;
+    return lowercase >= 97 && lowercase <= 122;
+}
+function isWindowsPath(path) {
+    if (path.length >= 2) {
+        const first = stringCodeUnitAt(path, 0);
+        const second = stringCodeUnitAt(path, 1);
+        if (isPathSeparatorCodeUnit(first) && isPathSeparatorCodeUnit(second))
+            return true;
+    }
+    return path.length >= 3 &&
+        isAsciiLetterCodeUnit(stringCodeUnitAt(path, 0)) &&
+        stringCodeUnitAt(path, 1) === COLON_CODE_UNIT &&
+        isPathSeparatorCodeUnit(stringCodeUnitAt(path, 2));
+}
+function normalizePathCodeUnit(codeUnit, foldAsciiCase) {
+    if (isPathSeparatorCodeUnit(codeUnit))
+        return FORWARD_SLASH_CODE_UNIT;
+    return foldAsciiCase &&
+        codeUnit >= ASCII_UPPERCASE_A_CODE_UNIT &&
+        codeUnit <= ASCII_UPPERCASE_Z_CODE_UNIT
+        ? codeUnit + ASCII_LOWERCASE_OFFSET
+        : codeUnit;
+}
+/**
+ * Replace every non-overlapping occurrence of a trusted path in untrusted text.
+ *
+ * Comparison treats slash and backslash as equivalent. Windows drive and UNC
+ * paths additionally use ASCII-only case folding, matching Windows path
+ * identity without locale-sensitive conversion. The linear-time matcher keeps
+ * the path literal: regex syntax in either input cannot change what matches.
+ */
+export function redactPathFromText(input, path, replacement) {
+    if (path.length === 0 || input.length < path.length)
+        return input;
+    const foldAsciiCase = isWindowsPath(path);
+    const patternLength = path.length;
+    const pattern = new NativeUint32Array(patternLength);
+    const prefixTable = new NativeUint32Array(patternLength);
+    for (let index = 0; index < patternLength; index++) {
+        pattern[index] = normalizePathCodeUnit(stringCodeUnitAt(path, index), foldAsciiCase);
+    }
+    prefixTable[0] = 0;
+    for (let index = 1, prefixLength = 0; index < patternLength;) {
+        if (pattern[index] === pattern[prefixLength]) {
+            prefixTable[index] = ++prefixLength;
+            index++;
+        }
+        else if (prefixLength > 0) {
+            prefixLength = prefixTable[prefixLength - 1];
+        }
+        else {
+            prefixTable[index] = 0;
+            index++;
+        }
+    }
+    let result = "";
+    let copyStart = 0;
+    let matchLength = 0;
+    for (let index = 0; index < input.length; index++) {
+        const codeUnit = normalizePathCodeUnit(stringCodeUnitAt(input, index), foldAsciiCase);
+        while (matchLength > 0 && codeUnit !== pattern[matchLength]) {
+            matchLength = prefixTable[matchLength - 1];
+        }
+        if (codeUnit === pattern[matchLength])
+            matchLength++;
+        if (matchLength !== patternLength)
+            continue;
+        const matchStart = index - patternLength + 1;
+        result += apply(stringSlice, input, [copyStart, matchStart]);
+        result += replacement;
+        copyStart = index + 1;
+        matchLength = 0;
+    }
+    return copyStart === 0 ? input : result + apply(stringSlice, input, [copyStart]);
 }
 /**
  * Normalized substrings that mark a key as sensitive. Matching is done against
@@ -61,9 +166,15 @@ const SENSITIVE_KEY_PATTERNS = [
     "csrf",
 ];
 const SENSITIVE_KEY_CACHE_MAX_SIZE = 512;
+/** Avoid retaining attacker-controlled, oversized property names in the cache. */
+const SENSITIVE_KEY_CACHE_MAX_KEY_LENGTH = 128;
 const sensitiveKeyCache = new Map();
 /** Stop traversing past this depth to keep the pass cheap and stack-safe. */
 const MAX_DEPTH = 16;
+/** Bound every individual array/object before allocating a redacted copy. */
+const MAX_CONTAINER_ENTRIES = 1_024;
+/** Bound aggregate work across an entire redaction call, not per branch. */
+const MAX_TRAVERSAL_NODES = 4_096;
 /**
  * Whether a context key names a credential and should have its value masked.
  *
@@ -73,39 +184,88 @@ const MAX_DEPTH = 16;
  * normalizes to `author`, which contains none of the patterns.
  */
 export function isSensitiveKey(key) {
-    const cached = sensitiveKeyCache.get(key);
-    if (cached !== undefined)
-        return cached;
+    const cacheable = key.length <= SENSITIVE_KEY_CACHE_MAX_KEY_LENGTH;
+    if (cacheable) {
+        const cached = sensitiveKeyCache.get(key);
+        if (cached !== undefined)
+            return cached;
+    }
     const normalized = normalizeToAlphanumeric(key);
     const sensitive = SENSITIVE_KEY_PATTERNS.some((pattern) => normalized.includes(pattern));
-    if (sensitiveKeyCache.size >= SENSITIVE_KEY_CACHE_MAX_SIZE) {
-        const oldestKey = sensitiveKeyCache.keys().next().value;
-        if (oldestKey !== undefined)
-            sensitiveKeyCache.delete(oldestKey);
+    if (cacheable) {
+        if (sensitiveKeyCache.size >= SENSITIVE_KEY_CACHE_MAX_SIZE) {
+            const oldestKey = sensitiveKeyCache.keys().next().value;
+            if (oldestKey !== undefined)
+                sensitiveKeyCache.delete(oldestKey);
+        }
+        sensitiveKeyCache.set(key, sensitive);
     }
-    sensitiveKeyCache.set(key, sensitive);
     return sensitive;
 }
 /**
- * A non-null, non-array object. {@link isRecord} covers class instances too,
- * whose enumerable fields `JSON.stringify` *would* serialize, so we must
- * traverse them to catch secrets.
+ * `Array.isArray` normally looks like a harmless classifier, but it throws for
+ * revoked proxies. Returning `null` lets every public redaction entry point
+ * fail closed without touching the unreadable value again.
  */
-function isTraversableRecord(value) {
-    return isRecord(value);
-}
-function hasToJson(value) {
-    return typeof value.toJSON === "function";
+function classifyArray(value) {
+    try {
+        return Array.isArray(value);
+    }
+    catch {
+        return null;
+    }
 }
-function redactValue(value, depth, seen) {
+function redactValue(value, depth, seen, mode, budget) {
+    if (budget.remainingNodes <= 0) {
+        budget.exhausted = true;
+        return REDACTED;
+    }
+    budget.remainingNodes--;
     if (typeof value === "string")
         return sanitizeUrlCredentials(value);
-    if (Array.isArray(value)) {
+    if (typeof value === "bigint")
+        return mode === "serialization" ? value.toString() : value;
+    if (typeof value === "number") {
+        return mode === "serialization" && !Number.isFinite(value) ? null : value;
+    }
+    if (typeof value === "boolean" || value === null)
+        return value;
+    if (typeof value === "undefined" || typeof value === "function" || typeof value === "symbol") {
+        return mode === "serialization" ? REDACTED : value;
+    }
+    const arrayClassification = classifyArray(value);
+    if (arrayClassification === null)
+        return REDACTED;
+    if (arrayClassification) {
         if (depth >= MAX_DEPTH || seen.has(value))
             return REDACTED;
         seen.add(value);
         try {
-            return value.map((item) => redactValue(item, depth + 1, seen));
+            const arrayValue = value;
+            const length = arrayValue.length;
+            if (!Number.isInteger(length) || length < 0 || length > MAX_CONTAINER_ENTRIES) {
+                return REDACTED;
+            }
+            const redacted = mode === "compatible" ? new Array(length) : [];
+            for (let index = 0; index < length; index++) {
+                if (mode === "compatible" && !(index in arrayValue))
+                    continue;
+                const item = redactValue(arrayValue[index], depth + 1, seen, mode, budget);
+                if (budget.exhausted)
+                    return REDACTED;
+                if (mode === "compatible") {
+                    redacted[index] = item;
+                }
+                else {
+                    redacted.push(item);
+                }
+            }
+            return redacted;
+        }
+        catch {
+            // Array indices can be accessors or proxy traps. A failed read makes the
+            // serialized contents unknowable, so the complete array fails closed.
+            return REDACTED;
         }
         finally {
             seen.delete(value);
@@ -116,24 +276,37 @@ function redactValue(value, depth, seen) {
     // enumerable keys. A key-based pass over the object's own properties would
     // therefore miss credentials smuggled through `toJSON`, e.g.
     // `{ toJSON: () => ({ apiKey: "sk-..." }) }` (CODEX P2). When `toJSON`
-    // returns a non-scalar (an object/array that could carry credential keys),
-    // redact *that* — the thing actually emitted. When it returns a scalar
-    // (Date/URL → ISO string), the original object is left intact, preserving
-    // prior behavior and identity.
-    if (isRecord(value) && hasToJson(value)) {
-        if (depth >= MAX_DEPTH || seen.has(value))
-            return REDACTED;
+    // returns an object, array, or scalar, the serialization API redacts *that*
+    // snapshot. The compatibility API keeps scalar serializers such as Date and
+    // URL intact, preserving the established generic return contract.
+    if (depth >= MAX_DEPTH || seen.has(value))
+        return REDACTED;
+    let toJSON;
+    try {
+        toJSON = value.toJSON;
+    }
+    catch {
+        // Accessors can throw before a serializer is callable. Never inspect the
+        // raw object after that because its eventual serialization is unknown.
+        return REDACTED;
+    }
+    if (typeof toJSON === "function") {
         seen.add(value);
         try {
-            const serialized = value.toJSON();
-            if (isRecord(serialized) || Array.isArray(serialized)) {
-                return redactValue(serialized, depth + 1, seen);
+            const serialized = apply(toJSON, value, []);
+            if (mode === "serialization") {
+                return redactValue(serialized, depth + 1, seen, mode, budget);
             }
             if (typeof serialized === "string") {
                 const sanitized = sanitizeUrlCredentials(serialized);
                 return sanitized === serialized ? value : sanitized;
             }
-            // Scalar result (string/number/…): the object serializes safely as-is.
+            if (serialized !== null && typeof serialized === "object") {
+                if (classifyArray(serialized) === null)
+                    return REDACTED;
+                return redactValue(serialized, depth + 1, seen, mode, budget);
+            }
+            // Other scalar results serialize safely as-is in compatibility mode.
             return value;
         }
         catch {
@@ -145,40 +318,79 @@ function redactValue(value, depth, seen) {
             seen.delete(value);
         }
     }
-    if (isTraversableRecord(value)) {
-        if (depth >= MAX_DEPTH || seen.has(value))
-            return REDACTED;
-        seen.add(value);
-        try {
-            const out = {};
-            for (const [key, child] of Object.entries(value)) {
-                out[key] = isSensitiveKey(key) ? REDACTED : redactValue(child, depth + 1, seen);
+    seen.add(value);
+    try {
+        const out = {};
+        const record = value;
+        let propertyCount = 0;
+        for (const key in record) {
+            if (!Object.hasOwn(record, key))
+                continue;
+            propertyCount++;
+            if (propertyCount > MAX_CONTAINER_ENTRIES)
+                return REDACTED;
+            if (isSensitiveKey(key)) {
+                Object.defineProperty(out, key, {
+                    configurable: true,
+                    enumerable: true,
+                    value: REDACTED,
+                    writable: true,
+                });
+                continue;
             }
-            return out;
-        }
-        catch {
-            // A throwing getter (or other access error) must never let an
-            // unredacted object through: fail closed.
-            return REDACTED;
-        }
-        finally {
-            seen.delete(value);
+            const child = record[key];
+            // Match JSON object semantics only for the explicit serialization API.
+            // The generic compatibility API retains undefined own properties.
+            if (mode === "serialization" && child === undefined)
+                continue;
+            const redactedChild = redactValue(child, depth + 1, seen, mode, budget);
+            if (budget.exhausted)
+                return REDACTED;
+            Object.defineProperty(out, key, {
+                configurable: true,
+                enumerable: true,
+                value: redactedChild,
+                writable: true,
+            });
         }
+        return out;
+    }
+    catch {
+        // A throwing getter (or other access error) must never let an
+        // unredacted object through: fail closed.
+        return REDACTED;
+    }
+    finally {
+        seen.delete(value);
     }
-    // Primitives and scalar-serializing objects (Date, URL, …) are returned
-    // untouched: except for string values above, they are not key/value bags we
-    // can safely rewrite.
-    return value;
 }
 /**
- * Returns a redacted deep copy of `context`. Any property whose key is
- * {@link isSensitiveKey} has its value replaced with {@link REDACTED}; nested
- * plain objects, class instances, and arrays are traversed. The input is never
- * mutated, and the pass fails closed (returns {@link REDACTED}) on cycles,
- * depth overflow, or a throwing getter.
+ * Returns a redacted copy of `context` while preserving the established source
+ * and runtime value shapes. Any property whose key is {@link isSensitiveKey}
+ * is replaced with {@link REDACTED}; nested records and arrays are traversed,
+ * while primitives and scalar-serializing objects retain their original types.
+ * The input is never mutated.
+ *
+ * Use {@link redactForSerialization} at JSON/logging boundaries where BigInt,
+ * functions, symbols, and custom `toJSON` implementations must be normalized.
  */
 export function redactSensitive(context) {
-    return redactValue(context, 0, new Set());
+    return redactValue(context, 0, new Set(), "compatible", {
+        remainingNodes: MAX_TRAVERSAL_NODES,
+        exhausted: false,
+    });
+}
+/**
+ * Returns a JSON-safe redacted snapshot of `context`. Sensitive keys are
+ * masked, nested values are traversed, BigInts become decimal strings,
+ * non-finite numbers become `null`, and unsupported or unreadable values fail
+ * closed. Objects with `toJSON` are snapshotted exactly once before redaction.
+ */
+export function redactForSerialization(context) {
+    return redactValue(context, 0, new Set(), "serialization", {
+        remainingNodes: MAX_TRAVERSAL_NODES,
+        exhausted: false,
+    });
 }
 /**
  * Query-string parameter names that commonly carry credentials in URLs.
@@ -201,9 +413,221 @@ const SENSITIVE_URL_PARAMS = [
     "sig",
     "signature",
     "auth",
+    "x-amz-credential",
+    "x-amz-signature",
+    "x-amz-security-token",
+    "x-goog-credential",
+    "x-goog-signature",
 ];
 const NORMALIZED_SENSITIVE_URL_PARAMS = new Set(SENSITIVE_URL_PARAMS.map(normalizeToAlphanumeric));
-const URL_USERINFO_RE = /(\b[a-z][a-z0-9+.-]*:\/\/)([^/?#@\s]+)@/gi;
+const URL_USERINFO_RE = /(\b[a-z][a-z0-9+.-]*:\/\/|\/\/)([^/?#\s]+)@/gi;
+const HORIZONTAL_WHITESPACE_URL_USERINFO_RE = /(\b[a-z][a-z0-9+.-]*:\/\/|\/\/)([a-z0-9._~!$&'()*+,;=%-]+):([^/?#@\r\n \t]+[ \t][^/?#@\r\n]*)@/gi;
+const MAX_URL_PARAMETER_DECODE_PASSES = 3;
+function isHorizontalAssignmentBoundary(character) {
+    return (character === " " ||
+        character === "\t" ||
+        character === "," ||
+        character === ";" ||
+        character === "&" ||
+        character === "?" ||
+        character === "#");
+}
+function isAsciiLetter(character) {
+    if (!character)
+        return false;
+    const code = character.charCodeAt(0);
+    return (code >= 65 && code <= 90) || (code >= 97 && code <= 122);
+}
+function isAssignmentKeyStartCharacter(character) {
+    return isAsciiLetter(character) || character === "_" || character === "$";
+}
+function isAssignmentKeyCharacter(character) {
+    if (!character)
+        return false;
+    const code = character.charCodeAt(0);
+    return (isAssignmentKeyStartCharacter(character) ||
+        (code >= 48 && code <= 57) ||
+        character === "." ||
+        character === "-");
+}
+/**
+ * Check for a syntactically recognizable next `key=value` / `"key": value`
+ * field without allocating substrings. Assignment values may themselves
+ * contain whitespace and punctuation, so only a complete next-field prefix is
+ * trusted as a boundary.
+ */
+function assignmentStartsAt(input, start) {
+    let index = start;
+    const keyQuote = input[index] === `"` || input[index] === "'" ? input[index++] : "";
+    if (!isAssignmentKeyStartCharacter(input[index]))
+        return false;
+    index++;
+    while (isAssignmentKeyCharacter(input[index]))
+        index++;
+    if (keyQuote) {
+        if (input[index] !== keyQuote)
+            return false;
+        index++;
+    }
+    while (input[index] === " " || input[index] === "\t")
+        index++;
+    return input[index] === ":" || input[index] === "=";
+}
+function isAssignmentBoundaryCharacter(character) {
+    return (character === "\r" ||
+        character === "\n" ||
+        character === "}" ||
+        character === "]" ||
+        isHorizontalAssignmentBoundary(character));
+}
+function skipAssignmentBoundaryCharacters(input, start) {
+    let index = start;
+    while (index < input.length &&
+        isAssignmentBoundaryCharacter(input[index])) {
+        index++;
+    }
+    return index;
+}
+function assignmentValueEndsAt(input, start) {
+    const boundaryEnd = skipAssignmentBoundaryCharacters(input, start);
+    return boundaryEnd >= input.length || assignmentStartsAt(input, boundaryEnd);
+}
+function redactAssignmentValue(input, start) {
+    let scanStart = start;
+    let preserveValueQuote = true;
+    if (input.startsWith(REDACTED, start)) {
+        const markerEnd = start + REDACTED.length;
+        if (assignmentValueEndsAt(input, markerEnd)) {
+            return {
+                end: markerEnd,
+                replacement: REDACTED,
+            };
+        }
+        scanStart = markerEnd;
+        preserveValueQuote = false;
+    }
+    const wrapperQuote = preserveValueQuote &&
+        (input[scanStart] === `"` || input[scanStart] === "'" || input[scanStart] === "`")
+        ? input[scanStart]
+        : "";
+    let wrapperQuoteClosed = false;
+    const replacement = () => wrapperQuote ? `${wrapperQuote}${REDACTED}${wrapperQuoteClosed ? wrapperQuote : ""}` : REDACTED;
+    const expectedClosings = [];
+    let quote = "";
+    let quoteStart = -1;
+    for (let index = scanStart; index < input.length;) {
+        const character = input[index];
+        if (quote) {
+            if (character === "\\") {
+                index += 2;
+                continue;
+            }
+            if (character === quote) {
+                if (quoteStart === scanStart && expectedClosings.length === 0) {
+                    wrapperQuoteClosed = true;
+                }
+                quote = "";
+                quoteStart = -1;
+            }
+            index++;
+            continue;
+        }
+        if (character === `"` || character === "'" || character === "`") {
+            quote = character;
+            quoteStart = index;
+            index++;
+            continue;
+        }
+        if (character === "{" || character === "[") {
+            expectedClosings.push(character === "{" ? "}" : "]");
+            index++;
+            continue;
+        }
+        if (expectedClosings.length > 0 &&
+            (character === "}" || character === "]")) {
+            if (expectedClosings.at(-1) !== character) {
+                return { end: input.length, replacement: replacement() };
+            }
+            expectedClosings.pop();
+            index++;
+            if (expectedClosings.length === 0 &&
+                assignmentValueEndsAt(input, index)) {
+                return { end: index, replacement: replacement() };
+            }
+            continue;
+        }
+        if (expectedClosings.length > 0 ||
+            !isAssignmentBoundaryCharacter(character)) {
+            index++;
+            continue;
+        }
+        const boundaryStart = index;
+        index = skipAssignmentBoundaryCharacters(input, index);
+        if (index >= input.length || assignmentStartsAt(input, index)) {
+            return { end: boundaryStart, replacement: replacement() };
+        }
+    }
+    return { end: input.length, replacement: replacement() };
+}
+function redactCredentialAssignments(input, prefixPattern, keyGroup, urlParameterBoundaryGroup) {
+    let cursor = 0;
+    let result = "";
+    for (let match = apply(regExpExec, prefixPattern, [input]); match; match = apply(regExpExec, prefixPattern, [input])) {
+        const key = match[keyGroup];
+        if (!isSensitiveKey(key))
+            continue;
+        const valueStart = prefixPattern.lastIndex;
+        const boundary = urlParameterBoundaryGroup === undefined
+            ? undefined
+            : match[urlParameterBoundaryGroup];
+        const markerEnd = valueStart + REDACTED.length;
+        if ((boundary === "?" || boundary === "&" || boundary === ";") &&
+            input.startsWith(REDACTED, valueStart) &&
+            input[markerEnd] === "#") {
+            // The URL-parameter pass already bounded this credential at the URI
+            // fragment delimiter. Preserve that delimiter without treating an
+            // arbitrary `[REDACTED]suffix` assignment as trustworthy.
+            continue;
+        }
+        const redactedValue = redactAssignmentValue(input, valueStart);
+        result += sliceString(input, cursor, match.index);
+        result += match[0];
+        result += redactedValue.replacement;
+        cursor = redactedValue.end;
+        prefixPattern.lastIndex = redactedValue.end;
+    }
+    return cursor === 0 ? input : result + sliceString(input, cursor);
+}
+function isStandaloneUrlAuthorityBeforeWhitespace(scheme, user, password) {
+    const whitespaceIndex = password.search(/[ \t]/);
+    if (whitespaceIndex < 0)
+        return false;
+    const authority = `${user}:${sliceString(password, 0, whitespaceIndex)}`;
+    const candidate = scheme === "//" ? `https://${authority}` : `${scheme}${authority}`;
+    try {
+        const url = new URL(candidate);
+        return url.username.length === 0 && url.password.length === 0;
+    }
+    catch {
+        return false;
+    }
+}
+function decodeUrlParameterName(value) {
+    let decoded = value;
+    for (let pass = 0; pass < MAX_URL_PARAMETER_DECODE_PASSES; pass++) {
+        let next;
+        try {
+            next = decodeURIComponent(decoded);
+        }
+        catch {
+            break;
+        }
+        if (next === decoded)
+            break;
+        decoded = next;
+    }
+    return decoded;
+}
 /**
  * Strip credentials from URL-shaped strings so they can be safely emitted in
  * free-form text (error messages, stacks, lifted `request_url` fields). Unlike
@@ -216,27 +640,78 @@ const URL_USERINFO_RE = /(\b[a-z][a-z0-9+.-]*:\/\/)([^/?#@\s]+)@/gi;
  * It is intentionally tolerant: it operates on any string (a DSN, a Mongo URI,
  * an axios error message containing a URL) via regex rather than requiring a
  * parseable URL, so malformed or partial URLs in error text are still scrubbed.
- * Non-URL strings pass through unchanged.
+ * Strings without credential-shaped content pass through unchanged.
  */
 export function sanitizeUrlCredentials(input) {
     if (typeof input !== "string" || input.length === 0)
         return input;
     // 1) userinfo: scheme://user:pass@  → mask the password (and any bare creds).
-    let out = input.replace(URL_USERINFO_RE, (_match, scheme, userinfo) => {
-        const colon = userinfo.indexOf(":");
-        if (colon === -1) {
-            // `scheme://token@host` — the whole userinfo is credential-like.
-            return `${scheme}${REDACTED}@`;
-        }
-        const user = userinfo.slice(0, colon);
-        return `${scheme}${user}:${REDACTED}@`;
-    });
+    let out = apply(regExpReplace, URL_USERINFO_RE, [
+        input,
+        (_match, scheme, userinfo) => {
+            const colon = userinfo.indexOf(":");
+            if (colon === -1) {
+                // `scheme://token@host` — the whole userinfo is credential-like.
+                return `${scheme}${REDACTED}@`;
+            }
+            const user = sliceString(userinfo, 0, colon);
+            return `${scheme}${user}:${REDACTED}@`;
+        },
+    ]);
+    out = apply(regExpReplace, HORIZONTAL_WHITESPACE_URL_USERINFO_RE, [
+        out,
+        (match, scheme, user, password) => {
+            // Do not reinterpret a complete URL followed later by an email address
+            // on the same line as malformed userinfo. Raw-horizontal-whitespace
+            // recovery is limited to explicit `user:password` shapes whose prefix
+            // cannot already be parsed as a standalone authority.
+            if (isStandaloneUrlAuthorityBeforeWhitespace(scheme, user, password)) {
+                return match;
+            }
+            return `${scheme}${user}:${REDACTED}@`;
+        },
+    ]);
     // 2) sensitive query/fragment params: `key=value` → `key=[REDACTED]`.
-    // Match `?key=`, `&key=`, `;key=` separators and stop at the next delimiter.
-    out = out.replace(/([?&;])([a-z0-9_.\-]+)=([^&#;\s]*)/gi, (match, sep, key, _val) => {
-        const sensitive = NORMALIZED_SENSITIVE_URL_PARAMS.has(normalizeToAlphanumeric(key));
-        return sensitive ? `${sep}${key}=${REDACTED}` : match;
-    });
+    // Match `?key=`, `#key=`, `&key=`, and `;key=` separators and stop at the
+    // next delimiter. OAuth implicit-flow tokens commonly appear after `#`.
+    out = apply(regExpReplace, /([?#&;])([-a-z0-9_.%\[\]]+)=([^&#;\s]*)/gi, [
+        out,
+        (match, sep, key, _val) => {
+            const decodedKey = decodeUrlParameterName(key);
+            const sensitive = NORMALIZED_SENSITIVE_URL_PARAMS.has(normalizeToAlphanumeric(decodedKey)) ||
+                isSensitiveKey(decodedKey);
+            return sensitive ? `${sep}${key}=${REDACTED}` : match;
+        },
+    ]);
+    // 3) Cookie header values.
+    // Cookie headers can carry multiple independent credentials separated by
+    // semicolons (and Set-Cookie attributes can contain commas). Mask the entire
+    // header line before the generic assignment scanner can stop at the first
+    // delimiter and expose later values.
+    out = apply(regExpReplace, /(^|[^a-z0-9_-])((?:set-cookie|cookie)\s*:\s*)[^\r\n]*/gi, [
+        out,
+        (_match, boundary, prefix) => `${boundary}${prefix}${REDACTED}`,
+    ]);
+    // 4) Header-shaped authorization values and standalone auth schemes.
+    // Authorization schemes are extensible (AWS SigV4, Digest, custom proxy
+    // schemes, and others), so mask the complete line instead of trying to
+    // enumerate schemes or parse their credential-bearing parameters.
+    out = apply(regExpReplace, /\b(authorization\s*[:=]\s*)[^\r\n]*/gi, [
+        out,
+        (_match, prefix) => `${prefix}${REDACTED}`,
+    ]);
+    out = apply(regExpReplace, /\b(bearer|basic)(\s+)(?:"[^"\r\n]*"|'[^'\r\n]*'|[a-z0-9._~+/=-]+)/gi, [
+        out,
+        (_match, scheme, whitespace) => `${scheme}${whitespace}${REDACTED}`,
+    ]);
+    // 5) Credential assignments embedded in free-form messages/errors. Match
+    // generic identifier-shaped keys and delegate classification to the same
+    // deny-list used for structured context. This keeps JSON snippets, header
+    // dumps, and ordinary `key=value` text from drifting to a weaker policy.
+    // Handle quoted JSON/object keys first and preserve their quoting so the
+    // sanitized text remains intelligible and structurally valid.
+    out = redactCredentialAssignments(out, /(["'])([_$a-z][a-z0-9_.$-]*)\1(\s*[:=]\s*)/gi, 2);
+    out = redactCredentialAssignments(out, /(^|[^a-z0-9_.$-])([_$a-z][a-z0-9_.$-]*)(\s*[:=]\s*)/gi, 2, 1);
     return out;
 }
 function firstUrlDelimiterIndex(input) {
@@ -273,21 +748,34 @@ export function sanitizeUrlForSpan(input) {
         return input;
     try {
         const url = new URL(input);
+        if (url.protocol === "blob:") {
+            try {
+                const embeddedUrl = new URL(url.pathname);
+                return embeddedUrl.origin === "null" ? "blob:" : `blob:${embeddedUrl.origin}`;
+            }
+            catch (_) {
+                return "blob:";
+            }
+        }
         if (url.origin !== "null")
             return `${url.origin}${url.pathname}`;
+        if (/^[a-z][a-z0-9+.-]*:/i.test(input))
+            return url.protocol;
     }
     catch (_) {
         // Relative or malformed URL-shaped strings are handled by the fallback.
     }
     const delimiterIndex = firstUrlDelimiterIndex(input);
-    const withoutQueryOrFragment = delimiterIndex === -1 ? input : input.slice(0, delimiterIndex);
+    const withoutQueryOrFragment = delimiterIndex === -1
+        ? input
+        : sliceString(input, 0, delimiterIndex);
     const protocolRelativeUrl = sanitizeProtocolRelativeUrlForSpan(withoutQueryOrFragment);
     if (protocolRelativeUrl)
         return protocolRelativeUrl;
     return sanitizeUrlCredentials(withoutQueryOrFragment);
 }
 /**
- * Apply {@link sanitizeUrlCredentials} to the `message` and `stack` of a
+ * Apply {@link sanitizeUrlCredentials} to the `name`, `message`, and `stack` of a
  * serialized-error-shaped object, returning a new object. Used by the logger's
  * JSON and text paths so errors carrying DSNs, Mongo URIs, or
  * `?access_token=`-bearing URLs do not leak credentials (the serialized error
@@ -297,6 +785,8 @@ export function sanitizeSerializedError(error) {
     if (!error)
         return error;
     const out = { ...error };
+    if (typeof out.name === "string")
+        out.name = sanitizeUrlCredentials(out.name);
     if (typeof out.message === "string")
         out.message = sanitizeUrlCredentials(out.message);
     if (typeof out.stack === "string")