@vtex/api 6.52.0 → 6.52.5

package/lib/service/worker/runtime/http/middlewares/sanitizeResponse.d.ts

@@ -0,0 +1,37 @@
+import { ServiceContext } from '../../typings';
+/**
+ * Setting this environment variable to `off` disables the sanitizer.
+ */
+export declare const RESPONSE_SANITIZER_SWITCH = "VTEX_IO_RESPONSE_SANITIZER";
+/**
+ * Sent when the body could not be sanitized: it is not known whether it is safe, so it is withheld.
+ */
+export declare const WITHHELD_BODY: {
+    code: string;
+    message: string;
+};
+export declare enum SanitizerReason {
+    ErrorRemoved = "error_object_removed",
+    SecretRemoved = "secret_removed",
+    LimitReached = "limit_reached",
+    Failed = "sanitizer_failed"
+}
+/**
+ * Removes error objects (`Error`, `AxiosError`) from the response body, so apps that write a caught
+ * error to `ctx.body` do not expose the request configuration (credentials), the stack and the
+ * connection internals to the caller.
+ *
+ * String bodies are also covered, for errors that were turned into text: the credentials in them
+ * (the ones of the request, the credential headers, `Bearer` tokens) are replaced.
+ *
+ * It must be registered after `compress()`, which serializes the body: it needs to see the object,
+ * and to change it before it is serialized.
+ *
+ * The body is also sanitized when the downstream handlers throw after having set it, as the error
+ * middleware keeps an existing body. If the sanitizer itself fails the body is withheld. If it
+ * cannot inspect the whole body, the response is sent and the limit is reported. It never throws.
+ *
+ * It is a backstop for apps that return errors by mistake. It is not a boundary against an app that
+ * wants to disclose its own credentials, which has them.
+ */
+export declare function sanitizeResponse(ctx: ServiceContext, next: () => Promise<void>): Promise<void>;

package/lib/service/worker/runtime/http/middlewares/sanitizeResponse.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeResponse = exports.SanitizerReason = exports.WITHHELD_BODY = exports.RESPONSE_SANITIZER_SWITCH = void 0;
+const constants_1 = require("../../../../../constants");
+const responseSanitizer_1 = require("../../../../../utils/responseSanitizer");
+const stringRedactor_1 = require("../../../../../utils/stringRedactor");
+/**
+ * Setting this environment variable to `off` disables the sanitizer.
+ */
+exports.RESPONSE_SANITIZER_SWITCH = 'VTEX_IO_RESPONSE_SANITIZER';
+/**
+ * Sent when the body could not be sanitized: it is not known whether it is safe, so it is withheld.
+ */
+exports.WITHHELD_BODY = {
+    code: 'E_RESPONSE_WITHHELD',
+    message: 'The response could not be safely returned.',
+};
+var SanitizerReason;
+(function (SanitizerReason) {
+    SanitizerReason["ErrorRemoved"] = "error_object_removed";
+    SanitizerReason["SecretRemoved"] = "secret_removed";
+    SanitizerReason["LimitReached"] = "limit_reached";
+    SanitizerReason["Failed"] = "sanitizer_failed";
+})(SanitizerReason = exports.SanitizerReason || (exports.SanitizerReason = {}));
+// Only the class of the error is reported: its message may carry what is being kept out.
+const errorName = (err) => err === null || err === void 0 ? void 0 : err.name;
+const warn = (ctx, reason, fields = {}) => {
+    var _a, _b, _c;
+    const payload = {
+        message: `response-sanitizer: ${reason}`,
+        reason,
+        routeId: (_b = (_a = ctx.vtex) === null || _a === void 0 ? void 0 : _a.route) === null || _b === void 0 ? void 0 : _b.id,
+        ...fields,
+    };
+    try {
+        if ((_c = ctx.vtex) === null || _c === void 0 ? void 0 : _c.logger) {
+            ctx.vtex.logger.warn(payload);
+        }
+        else {
+            console.warn(JSON.stringify(payload));
+        }
+    }
+    catch (err) {
+        // Logging must never break the response: the event goes to the process output instead.
+        console.warn(JSON.stringify({ ...payload, loggerErrorName: errorName(err) }));
+    }
+};
+const withholdBody = (ctx) => {
+    try {
+        if (ctx.status < 400) {
+            ctx.status = 500;
+        }
+        ctx.body = exports.WITHHELD_BODY;
+    }
+    catch (err) {
+        // There is nothing else that can be done safely: as a last resort the response is emptied.
+        ctx.body = null;
+        warn(ctx, SanitizerReason.Failed, { withholdErrorName: errorName(err) });
+    }
+};
+// A string body can hold an error that was turned into text (`JSON.stringify(error)`), which has
+// no error object left to find. What can be told apart is the credential itself.
+const redactStringBody = (ctx, body) => {
+    var _a;
+    const { authToken, adminUserAuthToken, storeUserAuthToken } = (_a = ctx.vtex) !== null && _a !== void 0 ? _a : {};
+    const { value, redacted } = (0, stringRedactor_1.redactSecrets)(body, [authToken, adminUserAuthToken, storeUserAuthToken]);
+    if (redacted === 0) {
+        return;
+    }
+    // Koa keeps the type already set when the body is a string, and updates the length.
+    ctx.body = value;
+    warn(ctx, SanitizerReason.SecretRemoved, { redactions: redacted });
+};
+const sanitizeCtxBody = (ctx) => {
+    try {
+        if (process.env[exports.RESPONSE_SANITIZER_SWITCH] === 'off') {
+            return;
+        }
+        const body = ctx.body;
+        if (typeof body === 'string') {
+            redactStringBody(ctx, body);
+            return;
+        }
+        if (body === null || typeof body !== 'object' || Buffer.isBuffer(body) || typeof body.pipe === 'function') {
+            return;
+        }
+        // Most bodies have no error. A scan decides that without the copying walk; the walk runs only
+        // once an error has been found, or the scan could not finish.
+        const scan = (0, responseSanitizer_1.scanForErrors)(body);
+        if (scan === 'clean') {
+            return;
+        }
+        const { value, replaced, truncated } = (0, responseSanitizer_1.sanitizeErrors)(body, { linked: constants_1.LINKED });
+        if (truncated) {
+            // What is beyond the limit is left as it is, outside an error. The response is still sent:
+            // withholding it would break the large legitimate responses. It is reported to be measured.
+            warn(ctx, SanitizerReason.LimitReached);
+        }
+        if (value === body) {
+            return;
+        }
+        // Koa sets `Content-Type: application/json` whenever an object is assigned to the body, which
+        // would override a type chosen by the app.
+        const contentType = ctx.response.get('Content-Type');
+        ctx.body = value;
+        if (contentType) {
+            ctx.set('Content-Type', contentType);
+        }
+        warn(ctx, SanitizerReason.ErrorRemoved, { errors: replaced });
+    }
+    catch (err) {
+        // Fails closed: whatever made it fail may also be hiding a credential.
+        withholdBody(ctx);
+        warn(ctx, SanitizerReason.Failed, { errorName: errorName(err) });
+    }
+};
+/**
+ * Removes error objects (`Error`, `AxiosError`) from the response body, so apps that write a caught
+ * error to `ctx.body` do not expose the request configuration (credentials), the stack and the
+ * connection internals to the caller.
+ *
+ * String bodies are also covered, for errors that were turned into text: the credentials in them
+ * (the ones of the request, the credential headers, `Bearer` tokens) are replaced.
+ *
+ * It must be registered after `compress()`, which serializes the body: it needs to see the object,
+ * and to change it before it is serialized.
+ *
+ * The body is also sanitized when the downstream handlers throw after having set it, as the error
+ * middleware keeps an existing body. If the sanitizer itself fails the body is withheld. If it
+ * cannot inspect the whole body, the response is sent and the limit is reported. It never throws.
+ *
+ * It is a backstop for apps that return errors by mistake. It is not a boundary against an app that
+ * wants to disclose its own credentials, which has them.
+ */
+async function sanitizeResponse(ctx, next) {
+    try {
+        await next();
+    }
+    finally {
+        sanitizeCtxBody(ctx);
+    }
+}
+exports.sanitizeResponse = sanitizeResponse;

package/lib/service/worker/runtime/statusTrack.js

@@ -14,10 +14,7 @@ const isStatusTrackBroadcast = (message) => message === BROADCAST_STATUS_TRACK;
 exports.isStatusTrackBroadcast = isStatusTrackBroadcast;
 const statusTrackHandler = async (ctx) => {
     var _a, _b, _c;
-    // Parity with the other builtin handlers: name the request so its samples don't
-    // land in the catch-all `handler="undefined"` bucket.
-    ctx.requestHandlerName = 'builtin:status-track';
-    (_b = (_a = ctx.tracing) === null || _a === void 0 ? void 0 : _a.currentSpan) === null || _b === void 0 ? void 0 : _b.setOperationName(ctx.requestHandlerName);
+    (_b = (_a = ctx.tracing) === null || _a === void 0 ? void 0 : _a.currentSpan) === null || _b === void 0 ? void 0 : _b.setOperationName('builtin:status-track');
     if (!constants_1.LINKED) {
         (_c = process.send) === null || _c === void 0 ? void 0 : _c.call(process, BROADCAST_STATUS_TRACK);
     }

package/lib/utils/buildFullPath.js

@@ -19,8 +19,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
  * @returns {string} The combined full path
  */
 function default_1(baseURL, requestedURL, allowAbsoluteUrls) {
-    let isRelativeUrl = !isAbsoluteURL(requestedURL);
-    if (baseURL && (isRelativeUrl || allowAbsoluteUrls == false)) {
+    const isRelativeUrl = !isAbsoluteURL(requestedURL);
+    if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) {
         return combineURLs(baseURL, requestedURL);
     }
     return requestedURL;

package/lib/utils/responseSanitizer.d.ts

@@ -0,0 +1,52 @@
+export interface SanitizeErrorsOptions {
+    /**
+     * When true (linked apps in development, and logs) the stack is kept to help debugging.
+     */
+    linked: boolean;
+    maxDepth?: number;
+    maxNodes?: number;
+    /**
+     * Total length of the arrays and objects visited, so that the cost of a long flat array is
+     * bounded the same as the number of containers.
+     */
+    maxValues?: number;
+}
+export interface SanitizeErrorsResult<T> {
+    /**
+     * The same reference received when nothing had to change.
+     */
+    value: T;
+    /**
+     * Number of error instances replaced by their safe representation.
+     */
+    replaced: number;
+    /**
+     * True when a limit (depth, containers, values) stopped the walk early. Outside an error the part
+     * not visited is left as it is. Inside an error it is replaced by a marker.
+     */
+    truncated: boolean;
+}
+/**
+ * Finds `Error` instances (including `AxiosError`) in a response body, at any depth of plain
+ * objects and arrays, and replaces each one by a safe representation: the message, name, code and
+ * status are kept, while the request config, the Node request, the agents, the upstream headers
+ * and, unless linked, the stack are removed.
+ *
+ * Strings, buffers, streams and class instances other than errors are returned untouched.
+ */
+export declare const sanitizeErrors: <T>(value: T, options: SanitizeErrorsOptions) => SanitizeErrorsResult<T>;
+export type ErrorScan = 'clean' | 'has-error' | 'truncated';
+/**
+ * Says whether `value` contains an `Error`, without copying it. The copying walk is only needed
+ * when this returns `has-error`. `truncated` means a budget (depth, containers, or the values they
+ * hold) was spent before the value was fully inspected, so whatever was not visited must not be sent.
+ */
+export declare const scanForErrors: (value: object, options?: Pick<SanitizeErrorsOptions, 'maxDepth' | 'maxNodes' | 'maxValues'>) => ErrorScan;
+/**
+ * The same as `sanitizeErrors` for what is written to the process output, where the stack is
+ * useful and kept. A thrown `Error` stays an error, so it is printed as one (stack, then its
+ * properties), without the request config, the request and the agents.
+ *
+ * It never throws.
+ */
+export declare const toLoggableError: (value: unknown) => unknown;

package/lib/utils/responseSanitizer.js

@@ -0,0 +1,354 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toLoggableError = exports.scanForErrors = exports.sanitizeErrors = void 0;
+const error_1 = require("./error");
+/**
+ * Properties of an error that hold HTTP-client internals: the request config (headers carry
+ * credentials), the Node request object, and the connection agents. They are never serialized.
+ * `response` is rebuilt separately, so that its headers and request are left out too.
+ */
+const INTERNAL_ERROR_KEYS = new Set(['config', 'request', 'httpAgent', 'httpsAgent', 'response']);
+const DEFAULT_MAX_DEPTH = 32;
+const DEFAULT_MAX_NODES = 200000;
+// What the containers hold, counted by their length. About 35 ms to go through on a laptop, which
+// is far past a legitimate response.
+const DEFAULT_MAX_VALUES = 5000000;
+const TRUNCATED = '[Truncated]';
+const CIRCULAR = '[Circular]';
+// `instanceof` is not enough for errors that come from another realm (a `vm` context), which
+// `Object.prototype.toString` still identifies.
+const isError = (node) => node instanceof Error || Object.prototype.toString.call(node) === '[object Error]';
+// Buffers and typed arrays, which have one entry per byte when walked as objects.
+const isBinary = (node) => Buffer.isBuffer(node) || ArrayBuffer.isView(node) || node instanceof ArrayBuffer;
+const isPlainObject = (node) => {
+    const proto = Object.getPrototypeOf(node);
+    return proto === Object.prototype || proto === null;
+};
+/**
+ * What is shown instead of a value that is kept out of an error: binary data, streams and
+ * instances of classes, which can hold large or circular graphs (sockets, agents, handles).
+ */
+const describeOpaque = (node) => {
+    var _a;
+    if (node instanceof Date) {
+        return Number.isNaN(node.getTime()) ? '[Invalid Date]' : node.toISOString();
+    }
+    const name = ((_a = node === null || node === void 0 ? void 0 : node.constructor) === null || _a === void 0 ? void 0 : _a.name) || 'Object';
+    if (isBinary(node)) {
+        return `[${name} ${node.byteLength} bytes]`;
+    }
+    return `[${name}]`;
+};
+class ErrorSanitizer {
+    constructor({ linked, maxDepth, maxNodes, maxValues }) {
+        this.replaced = 0;
+        this.truncated = false;
+        this.nodes = 0;
+        this.values = 0;
+        this.insideError = 0;
+        // The containers being walked, from the root. At most `maxDepth` + 1 of them, so searching it is
+        // cheaper than maintaining a set.
+        this.ancestors = [];
+        this.linked = linked;
+        this.maxDepth = maxDepth !== null && maxDepth !== void 0 ? maxDepth : DEFAULT_MAX_DEPTH;
+        this.maxNodes = maxNodes !== null && maxNodes !== void 0 ? maxNodes : DEFAULT_MAX_NODES;
+        this.maxValues = maxValues !== null && maxValues !== void 0 ? maxValues : DEFAULT_MAX_VALUES;
+    }
+    /**
+     * Copy-on-write walk: containers are copied only when something below them changed, and the
+     * received objects are never mutated (they may be frozen, cached or still in use by the app).
+     */
+    walk(node, depth) {
+        if (node === null || typeof node !== 'object') {
+            return node;
+        }
+        if (this.ancestors.includes(node)) {
+            // A cycle. Inside an error it must not lead back to the received error, which has the config
+            // and the request. In a body, serializing it fails regardless of this walk.
+            return this.insideError > 0 ? CIRCULAR : node;
+        }
+        if (depth > this.maxDepth || this.nodes >= this.maxNodes) {
+            // Not inspected. Inside an error it must not be returned (it may hold the config). Outside
+            // one it is left as it is: withholding the whole body would break the large responses.
+            this.truncated = true;
+            return this.insideError > 0 ? TRUNCATED : node;
+        }
+        this.nodes++;
+        // Arrays and plain objects are by far the most common, and cannot be errors, binary data or
+        // streams: they are checked first.
+        if (Array.isArray(node)) {
+            return this.walkArray(node, depth);
+        }
+        if (isPlainObject(node)) {
+            return this.walkObject(node, depth);
+        }
+        return this.walkOther(node, depth);
+    }
+    // Charged per container, when it is entered, so the loops that visit the values have no counter.
+    spend(values) {
+        this.values += values;
+        if (this.values > this.maxValues) {
+            this.truncated = true;
+            return false;
+        }
+        return true;
+    }
+    walkArray(node, depth) {
+        if (!this.spend(node.length)) {
+            return this.insideError > 0 ? TRUNCATED : node;
+        }
+        this.ancestors.push(node);
+        let result = node;
+        for (let i = 0; i < node.length; i++) {
+            const value = node[i];
+            const safe = this.walkValue(value, depth);
+            if (safe !== value) {
+                result = result === node ? node.slice() : result;
+                result[i] = safe;
+            }
+        }
+        this.ancestors.pop();
+        return result;
+    }
+    walkObject(node, depth) {
+        const keys = Object.keys(node);
+        if (!this.spend(keys.length)) {
+            return this.insideError > 0 ? TRUNCATED : node;
+        }
+        this.ancestors.push(node);
+        let result = node;
+        for (const key of keys) {
+            const value = node[key];
+            const safe = this.walkValue(value, depth);
+            if (safe !== value) {
+                result = result === node ? { ...node } : result;
+                result[key] = safe;
+            }
+        }
+        this.ancestors.pop();
+        return result;
+    }
+    // Most values are primitives: skipping them here avoids a call per value.
+    walkValue(value, depth) {
+        return value === null || typeof value !== 'object' ? value : this.walk(value, depth + 1);
+    }
+    // Errors, and what is neither a plain object nor an array: buffers, streams, class instances.
+    walkOther(node, depth) {
+        if (isError(node)) {
+            this.replaced++;
+            return this.toSafeError(node, depth);
+        }
+        return this.insideError > 0 ? describeOpaque(node) : node;
+    }
+    /**
+     * Builds the object that is exposed instead of the error. It is made from a shallow copy that
+     * leaves out the HTTP-client internals, so those are never traversed nor serialized, and goes
+     * through `cleanError` to keep the output consistent with the one of the global error handler
+     * (circular references, private and function properties, long strings).
+     *
+     * What reaches `cleanError` is bounded: values beyond the limits, binary data and class
+     * instances were replaced by markers while walking, because `cleanError` has no limits of its own.
+     */
+    toSafeError(error, depth) {
+        this.ancestors.push(error);
+        this.insideError++;
+        const source = error;
+        const copy = this.copyErrorProperties(source, depth);
+        const { response } = source;
+        if (response !== null && typeof response === 'object') {
+            copy.response = this.copyResponse(response, depth);
+        }
+        const safe = (0, error_1.cleanError)(copy);
+        // `cleanError` picks a fixed set of response properties, which leaves `statusText` out.
+        if (safe.response && typeof (response === null || response === void 0 ? void 0 : response.statusText) === 'string') {
+            safe.response.statusText = response.statusText;
+        }
+        this.insideError--;
+        this.ancestors.pop();
+        return safe;
+    }
+    copyErrorProperties(source, depth) {
+        const copy = {};
+        for (const key of Object.keys(source)) {
+            if (!INTERNAL_ERROR_KEYS.has(key)) {
+                copy[key] = this.walk(source[key], depth + 1);
+            }
+        }
+        for (const property of ['name', 'message', 'code']) {
+            if (typeof source[property] === 'string') {
+                copy[property] = source[property];
+            }
+        }
+        if (this.linked && typeof source.stack === 'string') {
+            copy.stack = source.stack;
+        }
+        return copy;
+    }
+    // Only what the upstream answered. Its headers (cookies, tokens) and the request that originated
+    // it are not exposed.
+    copyResponse(response, depth) {
+        return {
+            data: this.walk(response.data, depth + 1),
+            status: response.status,
+        };
+    }
+}
+/**
+ * Finds `Error` instances (including `AxiosError`) in a response body, at any depth of plain
+ * objects and arrays, and replaces each one by a safe representation: the message, name, code and
+ * status are kept, while the request config, the Node request, the agents, the upstream headers
+ * and, unless linked, the stack are removed.
+ *
+ * Strings, buffers, streams and class instances other than errors are returned untouched.
+ */
+const sanitizeErrors = (value, options) => {
+    const sanitizer = new ErrorSanitizer(options);
+    const sanitized = sanitizer.walk(value, 0);
+    return {
+        replaced: sanitizer.replaced,
+        truncated: sanitizer.truncated,
+        value: sanitized,
+    };
+};
+exports.sanitizeErrors = sanitizeErrors;
+const isPrimitiveValue = (value) => value === null || typeof value !== 'object';
+const enter = (budget, values) => {
+    if (budget.nodes >= budget.maxNodes) {
+        return false;
+    }
+    budget.nodes++;
+    budget.values += values;
+    return budget.values <= budget.maxValues;
+};
+// How far the linear pass may nest, in arrays and in objects alike. Deeper bodies fall through to
+// the scan below, which also enforces the depth limit.
+const SHALLOW_DEPTH = 4;
+// Lists of plain records, and an object wrapping them, are the common large payload. One pass
+// proves they hold no Error, which is cheaper than the copying walk and stops at the same budget.
+const shallowValue = (value, budget, depth) => {
+    // Arrays and plain objects first: they are the common case and cannot be errors.
+    if (Array.isArray(value)) {
+        return shallowArray(value, budget, depth);
+    }
+    if (isPlainObject(value)) {
+        return shallowRecord(value, budget, depth);
+    }
+    if (isError(value)) {
+        return 'has-error';
+    }
+    return enter(budget, 0) ? 'clean' : 'truncated';
+};
+// What is below a container that is not a primitive. Recursion stops at the cutoff, whatever the
+// container is, so its depth is bounded.
+const shallowChild = (child, budget, depth) => depth >= SHALLOW_DEPTH ? undefined : shallowValue(child, budget, depth + 1);
+const shallowArray = (items, budget, depth) => {
+    if (!enter(budget, items.length)) {
+        return 'truncated';
+    }
+    for (const item of items) {
+        if (isPrimitiveValue(item)) {
+            continue;
+        }
+        const found = shallowChild(item, budget, depth);
+        if (found !== 'clean') {
+            return found;
+        }
+    }
+    return 'clean';
+};
+const shallowRecord = (record, budget, depth) => {
+    const keys = Object.keys(record);
+    if (!enter(budget, keys.length)) {
+        return 'truncated';
+    }
+    for (const key of keys) {
+        const value = record[key];
+        if (isPrimitiveValue(value)) {
+            continue;
+        }
+        const found = shallowChild(value, budget, depth);
+        if (found !== 'clean') {
+            return found;
+        }
+    }
+    return 'clean';
+};
+const scanChildren = (node, depth, state) => {
+    const isArray = Array.isArray(node);
+    const record = node;
+    const keys = isArray ? undefined : Object.keys(record);
+    const length = keys ? keys.length : node.length;
+    state.values += length;
+    if (state.values > state.maxValues) {
+        state.truncated = true;
+        return;
+    }
+    state.ancestors.push(node);
+    for (let i = 0; i < length && !state.found && !state.truncated; i++) {
+        const child = keys ? record[keys[i]] : node[i];
+        if (child !== null && typeof child === 'object') {
+            scanNode(child, depth + 1, state);
+        }
+    }
+    state.ancestors.pop();
+};
+const scanNode = (node, depth, state) => {
+    if (state.found || state.truncated || state.ancestors.includes(node)) {
+        return;
+    }
+    if (depth > state.maxDepth || state.nodes >= state.maxNodes) {
+        state.truncated = true;
+        return;
+    }
+    state.nodes++;
+    if (Array.isArray(node) || isPlainObject(node)) {
+        scanChildren(node, depth, state);
+    }
+    else if (isError(node)) {
+        state.found = true;
+    }
+};
+const deepScan = (value, maxDepth, maxNodes, maxValues) => {
+    const state = { ancestors: [], found: false, maxDepth, maxNodes, maxValues, nodes: 0, truncated: false, values: 0 };
+    scanNode(value, 0, state);
+    if (state.truncated) {
+        return 'truncated';
+    }
+    return state.found ? 'has-error' : 'clean';
+};
+/**
+ * Says whether `value` contains an `Error`, without copying it. The copying walk is only needed
+ * when this returns `has-error`. `truncated` means a budget (depth, containers, or the values they
+ * hold) was spent before the value was fully inspected, so whatever was not visited must not be sent.
+ */
+const scanForErrors = (value, options = {}) => {
+    var _a, _b, _c;
+    const maxNodes = (_a = options.maxNodes) !== null && _a !== void 0 ? _a : DEFAULT_MAX_NODES;
+    const maxValues = (_b = options.maxValues) !== null && _b !== void 0 ? _b : DEFAULT_MAX_VALUES;
+    const shallow = shallowValue(value, { maxNodes, maxValues, nodes: 0, values: 0 }, 0);
+    if (shallow !== undefined) {
+        return shallow;
+    }
+    return deepScan(value, (_c = options.maxDepth) !== null && _c !== void 0 ? _c : DEFAULT_MAX_DEPTH, maxNodes, maxValues);
+};
+exports.scanForErrors = scanForErrors;
+/**
+ * The same as `sanitizeErrors` for what is written to the process output, where the stack is
+ * useful and kept. A thrown `Error` stays an error, so it is printed as one (stack, then its
+ * properties), without the request config, the request and the agents.
+ *
+ * It never throws.
+ */
+const toLoggableError = (value) => {
+    try {
+        const { value: safe } = (0, exports.sanitizeErrors)(value, { linked: true });
+        if (safe !== value && value !== null && typeof value === 'object' && isError(value)) {
+            return Object.assign(Object.create(Object.getPrototypeOf(value)), safe);
+        }
+        return safe;
+    }
+    catch (err) {
+        return `[error omitted: it could not be sanitized (${err === null || err === void 0 ? void 0 : err.name})]`;
+    }
+};
+exports.toLoggableError = toLoggableError;

package/lib/utils/stringRedactor.d.ts

@@ -0,0 +1,19 @@
+export declare const REDACTED = "[Redacted]";
+export interface RedactResult {
+    value: string;
+    /**
+     * How many occurrences were replaced. Zero means `value` is the received string.
+     */
+    redacted: number;
+}
+/**
+ * Replaces credentials in a text: the given secrets wherever they appear, the value of the
+ * credential headers in JSON text and in header lines, `Cookie` and `Set-Cookie` lines, the VTEX
+ * ID cookie, and `Bearer` tokens.
+ * The rest of the text is kept.
+ *
+ * It is for text that was built from an error, where the error object is no longer there to
+ * detect. It does not inspect anything else: a credential that is neither one of the secrets nor
+ * under one of those names is not found.
+ */
+export declare const redactSecrets: (text: string, secrets?: Array<string | undefined>) => RedactResult;