@vtex/api 6.52.1 → 6.52.5

package/CHANGELOG.md

@@ -7,6 +7,57 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## [6.52.5]
+
+### Security
+
+- Error objects assigned to the response body no longer expose the request
+  configuration, credentials, connection agents or, outside link mode, the
+  stack. If the response cannot be sanitized it is withheld. A body the walk cannot
+  inspect completely is sent as it is, and the limit is reported.
+- String response bodies built from an error (`` `failed: ${JSON.stringify(error)}` ``) no longer
+  expose its credentials: the request's tokens, the value of credential headers (`authorization`,
+  `proxy-authorization`, `VtexIdclientAutCookie`, `x-vtex-api-*`), the VTEX ID cookie and `Bearer`
+  tokens are replaced with `[Redacted]`. The same names are replaced when the request is
+  embedded as header lines (`Cookie`, `Set-Cookie`, `X-Vtex-Session`), not only as JSON keys.
+- The body the runtime builds from a thrown value goes through the same sanitizer. An error that is
+  a property of the thrown one (`originalError`), or sits in a thrown object, no longer exposes its
+  request configuration, request or stack, and the upstream response headers are no longer
+  included. Linked apps keep the stack but no longer get the configuration in the body.
+- Errors printed by the runtime no longer include the request configuration.
+- GraphQL error responses no longer include the stack outside link mode.
+
+## [6.52.4]
+### Fixed
+- `yarn test` no longer fails to even load `src/service/logger` and its transitive
+  dependents under `jest@25`: that resolver predates the package `exports` field, so
+  it couldn't resolve `@vtex/diagnostics-nodejs@0.1.0-beta.10`'s OpenTelemetry OTLP
+  exporter chain (reached via `@opentelemetry/otlp-exporter-base/node-http`), which is
+  loaded at module-eval time by nearly every service module. Stubbed the package for
+  tests via `jest.config.js` `moduleNameMapper` (see `jest/stubs/diagnosticsNodejs.js`);
+  the real telemetry/log-client paths are lazy and error-guarded, so this has no
+  behavioural effect on the code under test.
+- `TestServer.closeServer()`'s `new Promise((resolve) => ...)` failed to type-check
+  under strict `Promise<void>` typing; typed the executor explicitly.
+- The `axiosTracing.test.ts` "forcing ECONNREFUSED" suite pointed at `localhost`, which
+  Node's `autoSelectFamily` (Happy Eyeballs) resolves to both loopback addresses; since
+  both connections are refused, Node throws an `AggregateError` with an empty top-level
+  `message` instead of the plain `ECONNREFUSED` error the test asserts on. Uses the
+  literal `127.0.0.1` instead.
+
+## [6.52.2]
+### Fixed
+- TSLint violations across `src/axios.d.ts`, `src/caches/MultilayeredCache.ts`,
+  `src/HttpClient/middlewares/cache.ts`, `src/HttpClient/middlewares/request/index.ts`,
+  `src/HttpClient/middlewares/request/setupAxios/interceptors/tracing/spanSetup.ts`,
+  `src/service/logger/client.ts`, `src/service/logger/logger.ts`,
+  `src/service/telemetry/client.ts`,
+  `src/service/worker/runtime/graphql/schema/schemaDirectives/Auth.ts`,
+  `src/tracing/utils.test.ts` and `src/utils/buildFullPath.ts` (semicolon usage,
+  member ordering, `==` vs `===`, unsorted object keys, import ordering, and
+  other `tslint-config-vtex` rule failures) that were blocking the CI lint gate
+  on unrelated PRs against the 6.x line.
+
 ## [6.51.0] - 2026-06-23
 ### Added
 - Base `IOClients` getter `janusCatalogSystem` (Janus Catalog) and

package/lib/HttpClient/middlewares/cache.js

@@ -73,7 +73,7 @@ const cacheMiddleware = ({ type, storage, asyncSet }) => {
             ["key-with-segment" /* HttpCacheLogFields.KEY_WITH_SEGMENT */]: keyWithSegment,
         });
         const cacheReadSpan = createCacheSpan(cacheType, 'read', tracer, span);
-        let cached = undefined;
+        let cached;
         try {
             const cacheHasWithSegment = await storage.has(keyWithSegment);
             cached = cacheHasWithSegment ? await storage.get(keyWithSegment) : await storage.get(key);
@@ -114,7 +114,7 @@ const cacheMiddleware = ({ type, storage, asyncSet }) => {
             if (cachedEtag && validateStatus(response.status)) {
                 ctx.config.headers = {
                     ...ctx.config.headers,
-                    'if-none-match': cachedEtag
+                    'if-none-match': cachedEtag,
                 };
                 ctx.config.validateStatus = validateStatus;
             }

package/lib/HttpClient/middlewares/request/index.js

@@ -4,9 +4,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requestMiddleware = exports.routerCacheMiddleware = exports.defaultsMiddleware = void 0;
-const buildFullPath_1 = __importDefault(require("../../../utils/buildFullPath"));
 const qs_1 = require("qs");
 const ramda_1 = require("ramda");
+const buildFullPath_1 = __importDefault(require("../../../utils/buildFullPath"));
 const Tags_1 = require("../../../tracing/Tags");
 const renameBy_1 = require("../../../utils/renameBy");
 const setupAxios_1 = require("./setupAxios");

package/lib/HttpClient/middlewares/request/setupAxios/interceptors/tracing/spanSetup.js

@@ -4,10 +4,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.injectResponseInfoOnSpan = exports.injectRequestInfoOnSpan = void 0;
-const buildFullPath_1 = __importDefault(require("../../../../../../utils/buildFullPath"));
 const constants_1 = require("../../../../../../constants");
 const Tags_1 = require("../../../../../../tracing/Tags");
 const utils_1 = require("../../../../../../tracing/utils");
+const buildFullPath_1 = __importDefault(require("../../../../../../utils/buildFullPath"));
 const injectRequestInfoOnSpan = (span, http, config) => {
     span === null || span === void 0 ? void 0 : span.addTags({
         [Tags_1.OpentracingTags.SPAN_KIND]: Tags_1.OpentracingTags.SPAN_KIND_RPC_CLIENT,

package/lib/caches/MultilayeredCache.js

@@ -8,7 +8,7 @@ class MultilayeredCache {
         this.hits = 0;
         this.total = 0;
         this.get = async (key, fetcher) => {
-            let value = undefined;
+            let value;
             let maxAge;
             let successIndex = await this.findIndex(async (cache) => {
                 const [getValue, hasKey] = await Promise.all([cache.get(key), cache.has(key)]);

package/lib/service/logger/client.js

@@ -5,7 +5,7 @@ const diagnostics_nodejs_1 = require("@vtex/diagnostics-nodejs");
 const telemetry_1 = require("../telemetry");
 let logClient;
 let isInitializing = false;
-let initPromise = undefined;
+let initPromise;
 async function getLogClient(account, workspace, appName) {
     if (logClient) {
         return logClient;
@@ -23,11 +23,11 @@ async function initializeClient(account, workspace, appName) {
         const telemetryClient = await (0, telemetry_1.getTelemetryClient)();
         const logsConfig = diagnostics_nodejs_1.Exporters.CreateLogsExporterConfig({
             endpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT,
+            headers: { 'Content-Type': 'application/json' },
+            interval: 5,
             path: process.env.OTEL_EXPORTER_OTLP_PATH || '/v1/logs',
             protocol: 'http',
-            interval: 5,
             timeoutSeconds: 5,
-            headers: { 'Content-Type': 'application/json' },
         });
         const logsExporter = diagnostics_nodejs_1.Exporters.CreateExporter(logsConfig, 'otlp');
         await logsExporter.initialize();

package/lib/service/logger/logger.d.ts

@@ -9,10 +9,10 @@ export declare class Logger {
     private logClient;
     private clientInitPromise;
     constructor(ctx: LoggerContext);
-    private initLogClient;
     debug: (message: any) => void;
     info: (message: any) => void;
     warn: (warning: any) => void;
     error: (error: any) => void;
     log: (message: any, level: LogLevel) => void;
+    private initLogClient;
 }

package/lib/service/logger/logger.js

@@ -4,8 +4,8 @@ exports.Logger = void 0;
 const constants_1 = require("../../constants");
 const error_1 = require("../../utils/error");
 const log_1 = require("../../utils/log");
-const loggerTypes_1 = require("./loggerTypes");
 const client_1 = require("./client");
+const loggerTypes_1 = require("./loggerTypes");
 const app = constants_1.APP.ID;
 const EMPTY_MESSAGE = 'Logger.log was called with null or undefined message';
 class Logger {
@@ -42,7 +42,7 @@ class Logger {
             }
             if (this.logClient) {
                 try {
-                    let logMessage = typeof data === 'string' ? data : JSON.stringify(data);
+                    const logMessage = typeof data === 'string' ? data : JSON.stringify(data);
                     switch (level) {
                         case loggerTypes_1.LogLevel.Debug:
                             this.logClient.debug(logMessage, inflatedLog);
@@ -90,7 +90,7 @@ class Logger {
                 });
                 this.logClient = await Promise.race([
                     (0, client_1.getLogClient)(this.account, this.workspace, constants_1.APP.NAME),
-                    timeoutPromise
+                    timeoutPromise,
                 ]);
                 return this.logClient;
             }

package/lib/service/telemetry/client.js

@@ -4,21 +4,35 @@ exports.resetTelemetryClient = exports.getTelemetryClient = void 0;
 const diagnostics_nodejs_1 = require("@vtex/diagnostics-nodejs");
 const constants_1 = require("../../constants");
 class TelemetryClientSingleton {
-    constructor() {
-        this.initializationPromise = undefined;
-    }
     static getInstance() {
         if (!TelemetryClientSingleton.instance) {
             TelemetryClientSingleton.instance = new TelemetryClientSingleton();
         }
         return TelemetryClientSingleton.instance;
     }
+    constructor() {
+        this.initializationPromise = undefined;
+    }
+    async getClient() {
+        if (this.telemetryClient) {
+            return this.telemetryClient;
+        }
+        if (this.initializationPromise) {
+            return this.initializationPromise;
+        }
+        this.initializationPromise = this.initTelemetryClient();
+        return this.initializationPromise;
+    }
+    reset() {
+        this.telemetryClient = undefined;
+        this.initializationPromise = undefined;
+    }
     async initTelemetryClient() {
         try {
             const telemetryClient = await (0, diagnostics_nodejs_1.NewTelemetryClient)('node-vtex-api', constants_1.APP.ID || 'vtex-app', {
                 additionalAttrs: {
-                    'version': constants_1.APP.VERSION || '',
                     'environment': process.env.VTEX_WORKSPACE || 'development',
+                    'version': constants_1.APP.VERSION || '',
                 },
             });
             this.telemetryClient = telemetryClient;
@@ -32,20 +46,6 @@ class TelemetryClientSingleton {
             this.initializationPromise = undefined;
         }
     }
-    async getClient() {
-        if (this.telemetryClient) {
-            return this.telemetryClient;
-        }
-        if (this.initializationPromise) {
-            return this.initializationPromise;
-        }
-        this.initializationPromise = this.initTelemetryClient();
-        return this.initializationPromise;
-    }
-    reset() {
-        this.telemetryClient = undefined;
-        this.initializationPromise = undefined;
-    }
 }
 async function getTelemetryClient() {
     return TelemetryClientSingleton.getInstance().getClient();

package/lib/service/worker/index.js

@@ -26,6 +26,7 @@ const graphql_1 = require("./runtime/graphql");
 const http_2 = require("./runtime/http");
 const error_1 = require("./runtime/http/middlewares/error");
 const rateLimit_1 = require("./runtime/http/middlewares/rateLimit");
+const sanitizeResponse_1 = require("./runtime/http/middlewares/sanitizeResponse");
 const router_2 = require("./runtime/http/router");
 const routes_1 = require("./runtime/http/routes");
 const statusTrack_1 = require("./runtime/statusTrack");
@@ -163,7 +164,8 @@ const startWorker = (serviceJSON) => {
         .use((0, middlewares_1.addMetricsLoggerMiddleware)())
         .use((0, rateLimit_1.concurrentRateLimiter)((_a = serviceJSON === null || serviceJSON === void 0 ? void 0 : serviceJSON.rateLimitPerReplica) === null || _a === void 0 ? void 0 : _a.concurrent))
         .use((0, koa_compress_1.default)())
-        .use(middlewares_1.recorderMiddleware);
+        .use(middlewares_1.recorderMiddleware)
+        .use(sanitizeResponse_1.sanitizeResponse);
     const service = (0, loaders_1.getService)();
     const { config: { clients } } = service;
     if (clients) {

package/lib/service/worker/listeners.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.addProcessListeners = exports.logger = void 0;
 const os_1 = require("os");
 const RequestCancelledError_1 = require("../../errors/RequestCancelledError");
+const responseSanitizer_1 = require("../../utils/responseSanitizer");
 const logger_1 = require("../logger");
 exports.logger = new logger_1.Logger({ account: 'unhandled', workspace: 'unhandled', requestId: 'unhandled', operationId: 'unhandled', production: process.env.VTEX_PRODUCTION === 'true' });
 let watched;
@@ -15,18 +16,19 @@ const addProcessListeners = () => {
         return;
     }
     watched = process.on('uncaughtException', (err) => {
-        console.error('uncaughtException', err);
+        console.error('uncaughtException', (0, responseSanitizer_1.toLoggableError)(err));
         if (err && exports.logger) {
             err.type = 'uncaughtException';
             exports.logger.error(err);
         }
         process.exit(420);
     });
-    process.on('unhandledRejection', (reason, promise) => {
+    process.on('unhandledRejection', (reason) => {
         if (reason instanceof RequestCancelledError_1.RequestCancelledError) {
             return;
         }
-        console.error('unhandledRejection', reason, promise);
+        // The promise is not printed: inspecting it shows the rejection reason again, unsanitized.
+        console.error('unhandledRejection', (0, responseSanitizer_1.toLoggableError)(reason));
         if (reason && exports.logger) {
             reason.type = 'unhandledRejection';
             exports.logger.error(reason);

package/lib/service/worker/runtime/graphql/middlewares/error.js

@@ -36,8 +36,14 @@ const createLogErrorToSplunk = (vtex) => (err) => {
         logger.log(log, level);
     }
     finally {
-        if (!constants_1.LINKED && ((_f = (_e = err === null || err === void 0 ? void 0 : err.extensions) === null || _e === void 0 ? void 0 : _e.exception) === null || _f === void 0 ? void 0 : _f.sensitive)) {
-            delete err.extensions.exception.sensitive;
+        if (!constants_1.LINKED) {
+            // Already logged above. The response must not carry them.
+            if ((_f = (_e = err === null || err === void 0 ? void 0 : err.extensions) === null || _e === void 0 ? void 0 : _e.exception) === null || _f === void 0 ? void 0 : _f.sensitive) {
+                delete err.extensions.exception.sensitive;
+            }
+            if (err) {
+                delete err.stack;
+            }
         }
     }
 };

package/lib/service/worker/runtime/graphql/schema/schemaDirectives/Auth.js

@@ -50,7 +50,7 @@ async function auth(ctx, authArgs) {
     }
 }
 function parseArgs(authArgs) {
-    if (authArgs.scope == 'PUBLIC') {
+    if (authArgs.scope === 'PUBLIC') {
         return authArgs;
     }
     if (!authArgs.productCode || !authArgs.resourceCode) {
@@ -63,7 +63,7 @@ class Auth extends graphql_tools_1.SchemaDirectiveVisitor {
         const { resolve = graphql_1.defaultFieldResolver } = field;
         field.resolve = async (root, args, ctx, info) => {
             const authArgs = parseArgs(this.args);
-            if (!authArgs.scope || authArgs.scope == 'PRIVATE') {
+            if (!authArgs.scope || authArgs.scope === 'PRIVATE') {
                 await auth(ctx, authArgs);
             }
             return resolve(root, args, ctx, info);

package/lib/service/worker/runtime/http/middlewares/error.js

@@ -5,7 +5,9 @@ const constants_1 = require("../../../../../constants");
 const RequestCancelledError_1 = require("../../../../../errors/RequestCancelledError");
 const TooManyRequestsError_1 = require("../../../../../errors/TooManyRequestsError");
 const error_1 = require("../../../../../utils/error");
+const responseSanitizer_1 = require("../../../../../utils/responseSanitizer");
 const logger_1 = require("../../../../logger");
+const sanitizeResponse_1 = require("./sanitizeResponse");
 const CACHE_CONTROL_HEADER = 'cache-control';
 const META_HEADER = 'x-vtex-meta';
 const ETAG_HEADER = 'etag';
@@ -45,6 +47,19 @@ const logAndRemoveSensitiveData = (ctx, err) => {
         });
     }
 };
+// What is sent to the client for a thrown value. It is built with the sanitizer that covers the
+// bodies the app sets, so both paths expose the same: `cleanError` alone removes credentials only
+// at the top level, and by a short list of header names, so an error that is a property of the
+// thrown value (`originalError`) kept its config, request and stack.
+const buildResponseBody = (thrown) => {
+    try {
+        return (0, error_1.cleanError)((0, responseSanitizer_1.sanitizeErrors)(thrown, { linked: constants_1.LINKED }).value);
+    }
+    catch (sanitizeError) {
+        console.error('[node-vtex-api error] the thrown value could not be sanitized', sanitizeError === null || sanitizeError === void 0 ? void 0 : sanitizeError.name);
+        return sanitizeResponse_1.WITHHELD_BODY;
+    }
+};
 async function error(ctx, next) {
     var _a;
     try {
@@ -59,7 +74,8 @@ async function error(ctx, next) {
             ctx.status = TooManyRequestsError_1.tooManyRequestsStatus;
             return;
         }
-        console.error('[node-vtex-api error]', e);
+        // The raw error carries the request config, whose headers include credentials.
+        console.error('[node-vtex-api error]', (0, responseSanitizer_1.toLoggableError)(e));
         const err = (0, error_1.cleanError)(e);
         // Add response
         ctx.status = (e === null || e === void 0 ? void 0 : e.status) && e.status >= 400 && e.status <= 599
@@ -78,8 +94,10 @@ async function error(ctx, next) {
         else {
             ctx.set(CACHE_CONTROL_HEADER, `no-cache, no-store`);
         }
+        // `err` is what is logged, which keeps the config and the request to debug with. It is not the
+        // body: the sanitized value is.
         logAndRemoveSensitiveData(ctx, err);
-        ctx.body = ctx.body || err;
+        ctx.body = ctx.body || buildResponseBody(e);
     }
 }
 exports.error = error;

package/lib/service/worker/runtime/http/middlewares/sanitizeResponse.d.ts

@@ -0,0 +1,37 @@
+import { ServiceContext } from '../../typings';
+/**
+ * Setting this environment variable to `off` disables the sanitizer.
+ */
+export declare const RESPONSE_SANITIZER_SWITCH = "VTEX_IO_RESPONSE_SANITIZER";
+/**
+ * Sent when the body could not be sanitized: it is not known whether it is safe, so it is withheld.
+ */
+export declare const WITHHELD_BODY: {
+    code: string;
+    message: string;
+};
+export declare enum SanitizerReason {
+    ErrorRemoved = "error_object_removed",
+    SecretRemoved = "secret_removed",
+    LimitReached = "limit_reached",
+    Failed = "sanitizer_failed"
+}
+/**
+ * Removes error objects (`Error`, `AxiosError`) from the response body, so apps that write a caught
+ * error to `ctx.body` do not expose the request configuration (credentials), the stack and the
+ * connection internals to the caller.
+ *
+ * String bodies are also covered, for errors that were turned into text: the credentials in them
+ * (the ones of the request, the credential headers, `Bearer` tokens) are replaced.
+ *
+ * It must be registered after `compress()`, which serializes the body: it needs to see the object,
+ * and to change it before it is serialized.
+ *
+ * The body is also sanitized when the downstream handlers throw after having set it, as the error
+ * middleware keeps an existing body. If the sanitizer itself fails the body is withheld. If it
+ * cannot inspect the whole body, the response is sent and the limit is reported. It never throws.
+ *
+ * It is a backstop for apps that return errors by mistake. It is not a boundary against an app that
+ * wants to disclose its own credentials, which has them.
+ */
+export declare function sanitizeResponse(ctx: ServiceContext, next: () => Promise<void>): Promise<void>;

package/lib/service/worker/runtime/http/middlewares/sanitizeResponse.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeResponse = exports.SanitizerReason = exports.WITHHELD_BODY = exports.RESPONSE_SANITIZER_SWITCH = void 0;
+const constants_1 = require("../../../../../constants");
+const responseSanitizer_1 = require("../../../../../utils/responseSanitizer");
+const stringRedactor_1 = require("../../../../../utils/stringRedactor");
+/**
+ * Setting this environment variable to `off` disables the sanitizer.
+ */
+exports.RESPONSE_SANITIZER_SWITCH = 'VTEX_IO_RESPONSE_SANITIZER';
+/**
+ * Sent when the body could not be sanitized: it is not known whether it is safe, so it is withheld.
+ */
+exports.WITHHELD_BODY = {
+    code: 'E_RESPONSE_WITHHELD',
+    message: 'The response could not be safely returned.',
+};
+var SanitizerReason;
+(function (SanitizerReason) {
+    SanitizerReason["ErrorRemoved"] = "error_object_removed";
+    SanitizerReason["SecretRemoved"] = "secret_removed";
+    SanitizerReason["LimitReached"] = "limit_reached";
+    SanitizerReason["Failed"] = "sanitizer_failed";
+})(SanitizerReason = exports.SanitizerReason || (exports.SanitizerReason = {}));
+// Only the class of the error is reported: its message may carry what is being kept out.
+const errorName = (err) => err === null || err === void 0 ? void 0 : err.name;
+const warn = (ctx, reason, fields = {}) => {
+    var _a, _b, _c;
+    const payload = {
+        message: `response-sanitizer: ${reason}`,
+        reason,
+        routeId: (_b = (_a = ctx.vtex) === null || _a === void 0 ? void 0 : _a.route) === null || _b === void 0 ? void 0 : _b.id,
+        ...fields,
+    };
+    try {
+        if ((_c = ctx.vtex) === null || _c === void 0 ? void 0 : _c.logger) {
+            ctx.vtex.logger.warn(payload);
+        }
+        else {
+            console.warn(JSON.stringify(payload));
+        }
+    }
+    catch (err) {
+        // Logging must never break the response: the event goes to the process output instead.
+        console.warn(JSON.stringify({ ...payload, loggerErrorName: errorName(err) }));
+    }
+};
+const withholdBody = (ctx) => {
+    try {
+        if (ctx.status < 400) {
+            ctx.status = 500;
+        }
+        ctx.body = exports.WITHHELD_BODY;
+    }
+    catch (err) {
+        // There is nothing else that can be done safely: as a last resort the response is emptied.
+        ctx.body = null;
+        warn(ctx, SanitizerReason.Failed, { withholdErrorName: errorName(err) });
+    }
+};
+// A string body can hold an error that was turned into text (`JSON.stringify(error)`), which has
+// no error object left to find. What can be told apart is the credential itself.
+const redactStringBody = (ctx, body) => {
+    var _a;
+    const { authToken, adminUserAuthToken, storeUserAuthToken } = (_a = ctx.vtex) !== null && _a !== void 0 ? _a : {};
+    const { value, redacted } = (0, stringRedactor_1.redactSecrets)(body, [authToken, adminUserAuthToken, storeUserAuthToken]);
+    if (redacted === 0) {
+        return;
+    }
+    // Koa keeps the type already set when the body is a string, and updates the length.
+    ctx.body = value;
+    warn(ctx, SanitizerReason.SecretRemoved, { redactions: redacted });
+};
+const sanitizeCtxBody = (ctx) => {
+    try {
+        if (process.env[exports.RESPONSE_SANITIZER_SWITCH] === 'off') {
+            return;
+        }
+        const body = ctx.body;
+        if (typeof body === 'string') {
+            redactStringBody(ctx, body);
+            return;
+        }
+        if (body === null || typeof body !== 'object' || Buffer.isBuffer(body) || typeof body.pipe === 'function') {
+            return;
+        }
+        // Most bodies have no error. A scan decides that without the copying walk; the walk runs only
+        // once an error has been found, or the scan could not finish.
+        const scan = (0, responseSanitizer_1.scanForErrors)(body);
+        if (scan === 'clean') {
+            return;
+        }
+        const { value, replaced, truncated } = (0, responseSanitizer_1.sanitizeErrors)(body, { linked: constants_1.LINKED });
+        if (truncated) {
+            // What is beyond the limit is left as it is, outside an error. The response is still sent:
+            // withholding it would break the large legitimate responses. It is reported to be measured.
+            warn(ctx, SanitizerReason.LimitReached);
+        }
+        if (value === body) {
+            return;
+        }
+        // Koa sets `Content-Type: application/json` whenever an object is assigned to the body, which
+        // would override a type chosen by the app.
+        const contentType = ctx.response.get('Content-Type');
+        ctx.body = value;
+        if (contentType) {
+            ctx.set('Content-Type', contentType);
+        }
+        warn(ctx, SanitizerReason.ErrorRemoved, { errors: replaced });
+    }
+    catch (err) {
+        // Fails closed: whatever made it fail may also be hiding a credential.
+        withholdBody(ctx);
+        warn(ctx, SanitizerReason.Failed, { errorName: errorName(err) });
+    }
+};
+/**
+ * Removes error objects (`Error`, `AxiosError`) from the response body, so apps that write a caught
+ * error to `ctx.body` do not expose the request configuration (credentials), the stack and the
+ * connection internals to the caller.
+ *
+ * String bodies are also covered, for errors that were turned into text: the credentials in them
+ * (the ones of the request, the credential headers, `Bearer` tokens) are replaced.
+ *
+ * It must be registered after `compress()`, which serializes the body: it needs to see the object,
+ * and to change it before it is serialized.
+ *
+ * The body is also sanitized when the downstream handlers throw after having set it, as the error
+ * middleware keeps an existing body. If the sanitizer itself fails the body is withheld. If it
+ * cannot inspect the whole body, the response is sent and the limit is reported. It never throws.
+ *
+ * It is a backstop for apps that return errors by mistake. It is not a boundary against an app that
+ * wants to disclose its own credentials, which has them.
+ */
+async function sanitizeResponse(ctx, next) {
+    try {
+        await next();
+    }
+    finally {
+        sanitizeCtxBody(ctx);
+    }
+}
+exports.sanitizeResponse = sanitizeResponse;

package/lib/utils/buildFullPath.js

@@ -19,8 +19,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
  * @returns {string} The combined full path
  */
 function default_1(baseURL, requestedURL, allowAbsoluteUrls) {
-    let isRelativeUrl = !isAbsoluteURL(requestedURL);
-    if (baseURL && (isRelativeUrl || allowAbsoluteUrls == false)) {
+    const isRelativeUrl = !isAbsoluteURL(requestedURL);
+    if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) {
         return combineURLs(baseURL, requestedURL);
     }
     return requestedURL;

package/lib/utils/responseSanitizer.d.ts

@@ -0,0 +1,52 @@
+export interface SanitizeErrorsOptions {
+    /**
+     * When true (linked apps in development, and logs) the stack is kept to help debugging.
+     */
+    linked: boolean;
+    maxDepth?: number;
+    maxNodes?: number;
+    /**
+     * Total length of the arrays and objects visited, so that the cost of a long flat array is
+     * bounded the same as the number of containers.
+     */
+    maxValues?: number;
+}
+export interface SanitizeErrorsResult<T> {
+    /**
+     * The same reference received when nothing had to change.
+     */
+    value: T;
+    /**
+     * Number of error instances replaced by their safe representation.
+     */
+    replaced: number;
+    /**
+     * True when a limit (depth, containers, values) stopped the walk early. Outside an error the part
+     * not visited is left as it is. Inside an error it is replaced by a marker.
+     */
+    truncated: boolean;
+}
+/**
+ * Finds `Error` instances (including `AxiosError`) in a response body, at any depth of plain
+ * objects and arrays, and replaces each one by a safe representation: the message, name, code and
+ * status are kept, while the request config, the Node request, the agents, the upstream headers
+ * and, unless linked, the stack are removed.
+ *
+ * Strings, buffers, streams and class instances other than errors are returned untouched.
+ */
+export declare const sanitizeErrors: <T>(value: T, options: SanitizeErrorsOptions) => SanitizeErrorsResult<T>;
+export type ErrorScan = 'clean' | 'has-error' | 'truncated';
+/**
+ * Says whether `value` contains an `Error`, without copying it. The copying walk is only needed
+ * when this returns `has-error`. `truncated` means a budget (depth, containers, or the values they
+ * hold) was spent before the value was fully inspected, so whatever was not visited must not be sent.
+ */
+export declare const scanForErrors: (value: object, options?: Pick<SanitizeErrorsOptions, 'maxDepth' | 'maxNodes' | 'maxValues'>) => ErrorScan;
+/**
+ * The same as `sanitizeErrors` for what is written to the process output, where the stack is
+ * useful and kept. A thrown `Error` stays an error, so it is printed as one (stack, then its
+ * properties), without the request config, the request and the agents.
+ *
+ * It never throws.
+ */
+export declare const toLoggableError: (value: unknown) => unknown;

package/lib/utils/responseSanitizer.js

@@ -0,0 +1,354 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toLoggableError = exports.scanForErrors = exports.sanitizeErrors = void 0;
+const error_1 = require("./error");
+/**
+ * Properties of an error that hold HTTP-client internals: the request config (headers carry
+ * credentials), the Node request object, and the connection agents. They are never serialized.
+ * `response` is rebuilt separately, so that its headers and request are left out too.
+ */
+const INTERNAL_ERROR_KEYS = new Set(['config', 'request', 'httpAgent', 'httpsAgent', 'response']);
+const DEFAULT_MAX_DEPTH = 32;
+const DEFAULT_MAX_NODES = 200000;
+// What the containers hold, counted by their length. About 35 ms to go through on a laptop, which
+// is far past a legitimate response.
+const DEFAULT_MAX_VALUES = 5000000;
+const TRUNCATED = '[Truncated]';
+const CIRCULAR = '[Circular]';
+// `instanceof` is not enough for errors that come from another realm (a `vm` context), which
+// `Object.prototype.toString` still identifies.
+const isError = (node) => node instanceof Error || Object.prototype.toString.call(node) === '[object Error]';
+// Buffers and typed arrays, which have one entry per byte when walked as objects.
+const isBinary = (node) => Buffer.isBuffer(node) || ArrayBuffer.isView(node) || node instanceof ArrayBuffer;
+const isPlainObject = (node) => {
+    const proto = Object.getPrototypeOf(node);
+    return proto === Object.prototype || proto === null;
+};
+/**
+ * What is shown instead of a value that is kept out of an error: binary data, streams and
+ * instances of classes, which can hold large or circular graphs (sockets, agents, handles).
+ */
+const describeOpaque = (node) => {
+    var _a;
+    if (node instanceof Date) {
+        return Number.isNaN(node.getTime()) ? '[Invalid Date]' : node.toISOString();
+    }
+    const name = ((_a = node === null || node === void 0 ? void 0 : node.constructor) === null || _a === void 0 ? void 0 : _a.name) || 'Object';
+    if (isBinary(node)) {
+        return `[${name} ${node.byteLength} bytes]`;
+    }
+    return `[${name}]`;
+};
+class ErrorSanitizer {
+    constructor({ linked, maxDepth, maxNodes, maxValues }) {
+        this.replaced = 0;
+        this.truncated = false;
+        this.nodes = 0;
+        this.values = 0;
+        this.insideError = 0;
+        // The containers being walked, from the root. At most `maxDepth` + 1 of them, so searching it is
+        // cheaper than maintaining a set.
+        this.ancestors = [];
+        this.linked = linked;
+        this.maxDepth = maxDepth !== null && maxDepth !== void 0 ? maxDepth : DEFAULT_MAX_DEPTH;
+        this.maxNodes = maxNodes !== null && maxNodes !== void 0 ? maxNodes : DEFAULT_MAX_NODES;
+        this.maxValues = maxValues !== null && maxValues !== void 0 ? maxValues : DEFAULT_MAX_VALUES;
+    }
+    /**
+     * Copy-on-write walk: containers are copied only when something below them changed, and the
+     * received objects are never mutated (they may be frozen, cached or still in use by the app).
+     */
+    walk(node, depth) {
+        if (node === null || typeof node !== 'object') {
+            return node;
+        }
+        if (this.ancestors.includes(node)) {
+            // A cycle. Inside an error it must not lead back to the received error, which has the config
+            // and the request. In a body, serializing it fails regardless of this walk.
+            return this.insideError > 0 ? CIRCULAR : node;
+        }
+        if (depth > this.maxDepth || this.nodes >= this.maxNodes) {
+            // Not inspected. Inside an error it must not be returned (it may hold the config). Outside
+            // one it is left as it is: withholding the whole body would break the large responses.
+            this.truncated = true;
+            return this.insideError > 0 ? TRUNCATED : node;
+        }
+        this.nodes++;
+        // Arrays and plain objects are by far the most common, and cannot be errors, binary data or
+        // streams: they are checked first.
+        if (Array.isArray(node)) {
+            return this.walkArray(node, depth);
+        }
+        if (isPlainObject(node)) {
+            return this.walkObject(node, depth);
+        }
+        return this.walkOther(node, depth);
+    }
+    // Charged per container, when it is entered, so the loops that visit the values have no counter.
+    spend(values) {
+        this.values += values;
+        if (this.values > this.maxValues) {
+            this.truncated = true;
+            return false;
+        }
+        return true;
+    }
+    walkArray(node, depth) {
+        if (!this.spend(node.length)) {
+            return this.insideError > 0 ? TRUNCATED : node;
+        }
+        this.ancestors.push(node);
+        let result = node;
+        for (let i = 0; i < node.length; i++) {
+            const value = node[i];
+            const safe = this.walkValue(value, depth);
+            if (safe !== value) {
+                result = result === node ? node.slice() : result;
+                result[i] = safe;
+            }
+        }
+        this.ancestors.pop();
+        return result;
+    }
+    walkObject(node, depth) {
+        const keys = Object.keys(node);
+        if (!this.spend(keys.length)) {
+            return this.insideError > 0 ? TRUNCATED : node;
+        }
+        this.ancestors.push(node);
+        let result = node;
+        for (const key of keys) {
+            const value = node[key];
+            const safe = this.walkValue(value, depth);
+            if (safe !== value) {
+                result = result === node ? { ...node } : result;
+                result[key] = safe;
+            }
+        }
+        this.ancestors.pop();
+        return result;
+    }
+    // Most values are primitives: skipping them here avoids a call per value.
+    walkValue(value, depth) {
+        return value === null || typeof value !== 'object' ? value : this.walk(value, depth + 1);
+    }
+    // Errors, and what is neither a plain object nor an array: buffers, streams, class instances.
+    walkOther(node, depth) {
+        if (isError(node)) {
+            this.replaced++;
+            return this.toSafeError(node, depth);
+        }
+        return this.insideError > 0 ? describeOpaque(node) : node;
+    }
+    /**
+     * Builds the object that is exposed instead of the error. It is made from a shallow copy that
+     * leaves out the HTTP-client internals, so those are never traversed nor serialized, and goes
+     * through `cleanError` to keep the output consistent with the one of the global error handler
+     * (circular references, private and function properties, long strings).
+     *
+     * What reaches `cleanError` is bounded: values beyond the limits, binary data and class
+     * instances were replaced by markers while walking, because `cleanError` has no limits of its own.
+     */
+    toSafeError(error, depth) {
+        this.ancestors.push(error);
+        this.insideError++;
+        const source = error;
+        const copy = this.copyErrorProperties(source, depth);
+        const { response } = source;
+        if (response !== null && typeof response === 'object') {
+            copy.response = this.copyResponse(response, depth);
+        }
+        const safe = (0, error_1.cleanError)(copy);
+        // `cleanError` picks a fixed set of response properties, which leaves `statusText` out.
+        if (safe.response && typeof (response === null || response === void 0 ? void 0 : response.statusText) === 'string') {
+            safe.response.statusText = response.statusText;
+        }
+        this.insideError--;
+        this.ancestors.pop();
+        return safe;
+    }
+    copyErrorProperties(source, depth) {
+        const copy = {};
+        for (const key of Object.keys(source)) {
+            if (!INTERNAL_ERROR_KEYS.has(key)) {
+                copy[key] = this.walk(source[key], depth + 1);
+            }
+        }
+        for (const property of ['name', 'message', 'code']) {
+            if (typeof source[property] === 'string') {
+                copy[property] = source[property];
+            }
+        }
+        if (this.linked && typeof source.stack === 'string') {
+            copy.stack = source.stack;
+        }
+        return copy;
+    }
+    // Only what the upstream answered. Its headers (cookies, tokens) and the request that originated
+    // it are not exposed.
+    copyResponse(response, depth) {
+        return {
+            data: this.walk(response.data, depth + 1),
+            status: response.status,
+        };
+    }
+}
+/**
+ * Finds `Error` instances (including `AxiosError`) in a response body, at any depth of plain
+ * objects and arrays, and replaces each one by a safe representation: the message, name, code and
+ * status are kept, while the request config, the Node request, the agents, the upstream headers
+ * and, unless linked, the stack are removed.
+ *
+ * Strings, buffers, streams and class instances other than errors are returned untouched.
+ */
+const sanitizeErrors = (value, options) => {
+    const sanitizer = new ErrorSanitizer(options);
+    const sanitized = sanitizer.walk(value, 0);
+    return {
+        replaced: sanitizer.replaced,
+        truncated: sanitizer.truncated,
+        value: sanitized,
+    };
+};
+exports.sanitizeErrors = sanitizeErrors;
+const isPrimitiveValue = (value) => value === null || typeof value !== 'object';
+const enter = (budget, values) => {
+    if (budget.nodes >= budget.maxNodes) {
+        return false;
+    }
+    budget.nodes++;
+    budget.values += values;
+    return budget.values <= budget.maxValues;
+};
+// How far the linear pass may nest, in arrays and in objects alike. Deeper bodies fall through to
+// the scan below, which also enforces the depth limit.
+const SHALLOW_DEPTH = 4;
+// Lists of plain records, and an object wrapping them, are the common large payload. One pass
+// proves they hold no Error, which is cheaper than the copying walk and stops at the same budget.
+const shallowValue = (value, budget, depth) => {
+    // Arrays and plain objects first: they are the common case and cannot be errors.
+    if (Array.isArray(value)) {
+        return shallowArray(value, budget, depth);
+    }
+    if (isPlainObject(value)) {
+        return shallowRecord(value, budget, depth);
+    }
+    if (isError(value)) {
+        return 'has-error';
+    }
+    return enter(budget, 0) ? 'clean' : 'truncated';
+};
+// What is below a container that is not a primitive. Recursion stops at the cutoff, whatever the
+// container is, so its depth is bounded.
+const shallowChild = (child, budget, depth) => depth >= SHALLOW_DEPTH ? undefined : shallowValue(child, budget, depth + 1);
+const shallowArray = (items, budget, depth) => {
+    if (!enter(budget, items.length)) {
+        return 'truncated';
+    }
+    for (const item of items) {
+        if (isPrimitiveValue(item)) {
+            continue;
+        }
+        const found = shallowChild(item, budget, depth);
+        if (found !== 'clean') {
+            return found;
+        }
+    }
+    return 'clean';
+};
+const shallowRecord = (record, budget, depth) => {
+    const keys = Object.keys(record);
+    if (!enter(budget, keys.length)) {
+        return 'truncated';
+    }
+    for (const key of keys) {
+        const value = record[key];
+        if (isPrimitiveValue(value)) {
+            continue;
+        }
+        const found = shallowChild(value, budget, depth);
+        if (found !== 'clean') {
+            return found;
+        }
+    }
+    return 'clean';
+};
+const scanChildren = (node, depth, state) => {
+    const isArray = Array.isArray(node);
+    const record = node;
+    const keys = isArray ? undefined : Object.keys(record);
+    const length = keys ? keys.length : node.length;
+    state.values += length;
+    if (state.values > state.maxValues) {
+        state.truncated = true;
+        return;
+    }
+    state.ancestors.push(node);
+    for (let i = 0; i < length && !state.found && !state.truncated; i++) {
+        const child = keys ? record[keys[i]] : node[i];
+        if (child !== null && typeof child === 'object') {
+            scanNode(child, depth + 1, state);
+        }
+    }
+    state.ancestors.pop();
+};
+const scanNode = (node, depth, state) => {
+    if (state.found || state.truncated || state.ancestors.includes(node)) {
+        return;
+    }
+    if (depth > state.maxDepth || state.nodes >= state.maxNodes) {
+        state.truncated = true;
+        return;
+    }
+    state.nodes++;
+    if (Array.isArray(node) || isPlainObject(node)) {
+        scanChildren(node, depth, state);
+    }
+    else if (isError(node)) {
+        state.found = true;
+    }
+};
+const deepScan = (value, maxDepth, maxNodes, maxValues) => {
+    const state = { ancestors: [], found: false, maxDepth, maxNodes, maxValues, nodes: 0, truncated: false, values: 0 };
+    scanNode(value, 0, state);
+    if (state.truncated) {
+        return 'truncated';
+    }
+    return state.found ? 'has-error' : 'clean';
+};
+/**
+ * Says whether `value` contains an `Error`, without copying it. The copying walk is only needed
+ * when this returns `has-error`. `truncated` means a budget (depth, containers, or the values they
+ * hold) was spent before the value was fully inspected, so whatever was not visited must not be sent.
+ */
+const scanForErrors = (value, options = {}) => {
+    var _a, _b, _c;
+    const maxNodes = (_a = options.maxNodes) !== null && _a !== void 0 ? _a : DEFAULT_MAX_NODES;
+    const maxValues = (_b = options.maxValues) !== null && _b !== void 0 ? _b : DEFAULT_MAX_VALUES;
+    const shallow = shallowValue(value, { maxNodes, maxValues, nodes: 0, values: 0 }, 0);
+    if (shallow !== undefined) {
+        return shallow;
+    }
+    return deepScan(value, (_c = options.maxDepth) !== null && _c !== void 0 ? _c : DEFAULT_MAX_DEPTH, maxNodes, maxValues);
+};
+exports.scanForErrors = scanForErrors;
+/**
+ * The same as `sanitizeErrors` for what is written to the process output, where the stack is
+ * useful and kept. A thrown `Error` stays an error, so it is printed as one (stack, then its
+ * properties), without the request config, the request and the agents.
+ *
+ * It never throws.
+ */
+const toLoggableError = (value) => {
+    try {
+        const { value: safe } = (0, exports.sanitizeErrors)(value, { linked: true });
+        if (safe !== value && value !== null && typeof value === 'object' && isError(value)) {
+            return Object.assign(Object.create(Object.getPrototypeOf(value)), safe);
+        }
+        return safe;
+    }
+    catch (err) {
+        return `[error omitted: it could not be sanitized (${err === null || err === void 0 ? void 0 : err.name})]`;
+    }
+};
+exports.toLoggableError = toLoggableError;

package/lib/utils/stringRedactor.d.ts

@@ -0,0 +1,19 @@
+export declare const REDACTED = "[Redacted]";
+export interface RedactResult {
+    value: string;
+    /**
+     * How many occurrences were replaced. Zero means `value` is the received string.
+     */
+    redacted: number;
+}
+/**
+ * Replaces credentials in a text: the given secrets wherever they appear, the value of the
+ * credential headers in JSON text and in header lines, `Cookie` and `Set-Cookie` lines, the VTEX
+ * ID cookie, and `Bearer` tokens.
+ * The rest of the text is kept.
+ *
+ * It is for text that was built from an error, where the error object is no longer there to
+ * detect. It does not inspect anything else: a credential that is neither one of the secrets nor
+ * under one of those names is not found.
+ */
+export declare const redactSecrets: (text: string, secrets?: Array<string | undefined>) => RedactResult;

package/lib/utils/stringRedactor.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactSecrets = exports.REDACTED = void 0;
+exports.REDACTED = '[Redacted]';
+// Shorter values are not credentials, and replacing them everywhere would damage ordinary text.
+const MIN_SECRET_LENGTH = 16;
+/**
+ * Names under which credentials travel in HTTP headers. When an error is turned into text with
+ * `JSON.stringify`, its request config, and the headers in it, end up in the text under these keys.
+ */
+const SENSITIVE_KEYS = [
+    'authorization',
+    'cookie',
+    'proxy-authorization',
+    'vtexidclientautcookie',
+    'x-vtex-api-appkey',
+    'x-vtex-api-apptoken',
+    'x-vtex-credential',
+    'x-vtex-session',
+];
+// `"key":"value"`, also when the text was serialized twice (`\"key\":\"value\"`). Captures
+// everything up to the value, which is what is replaced. The value is a run of characters that are
+// not a quote, where a backslash only escapes the character after it. The two alternatives of the
+// run exclude each other, so the match is linear.
+const KEYED_VALUE = new RegExp(String.raw `(\\{0,2}"(?:${SENSITIVE_KEYS.join('|')})\\{0,2}"\s*:\s*\\{0,2}")(?:[^"\\]|\\[^"])+`, 'gi');
+// A header written as a line of the request (`Proxy-Authorization: value`), which is how a
+// serialized request object (`_header`) holds it. Short values are not credentials. `Cookie` is
+// not in this list: the word opens ordinary sentences, so its lines are matched separately.
+const HEADER_LINE_NAMES = [
+    'authorization',
+    'proxy-authorization',
+    'vtexidclientautcookie',
+    'x-vtex-api-appkey',
+    'x-vtex-api-apptoken',
+    'x-vtex-credential',
+    'x-vtex-session',
+];
+// The name starts a line. In a serialized request the line break is the two characters `\n`, so a
+// word boundary never fires there: the `n` and the name are both word characters.
+const AT_LINE_START = String.raw `(?<=^|\\n|\\r|\n|\r)`;
+const HEADER_LINE = new RegExp(String.raw `${AT_LINE_START}((?:${HEADER_LINE_NAMES.join('|')})[ \t]*:[ \t]*)[^\s"\\][^\r\n"\\]{7,}`, 'gi');
+// A `Cookie` or `Set-Cookie` line. The value has to be cookie pairs (`name=value`), so a sentence
+// that happens to start with "Cookie:" is left as it is.
+const COOKIE_LINE = new RegExp(String.raw `${AT_LINE_START}((?:set-)?cookie[ \t]*:[ \t]*)[^\s=;"\\]+=[^\r\n"\\]{6,}`, 'gi');
+// The VTEX ID cookie, in a `Cookie` header or a `Set-Cookie` line.
+const VTEX_ID_COOKIE = /\b(VtexIdclientAutCookie(?:_[a-z0-9-]+)?=)[^;\s"\\]+/gi;
+// An `Authorization` value that is not under a key, as in a message or a copied header line.
+const BEARER_TOKEN = /\b(Bearer\s+)[a-z0-9._~+/=-]{16,}/gi;
+const redactKnown = (text, secrets) => {
+    let value = text;
+    let redacted = 0;
+    for (const secret of secrets) {
+        if (!secret || secret.length < MIN_SECRET_LENGTH || !value.includes(secret)) {
+            continue;
+        }
+        const parts = value.split(secret);
+        redacted += parts.length - 1;
+        value = parts.join(exports.REDACTED);
+    }
+    return { redacted, value };
+};
+const redactPattern = (text, pattern) => {
+    let redacted = 0;
+    const value = text.replace(pattern, (match, prefix) => {
+        if (match === `${prefix}${exports.REDACTED}`) {
+            return match;
+        }
+        redacted++;
+        return `${prefix}${exports.REDACTED}`;
+    });
+    return { redacted, value: redacted > 0 ? value : text };
+};
+/**
+ * Replaces credentials in a text: the given secrets wherever they appear, the value of the
+ * credential headers in JSON text and in header lines, `Cookie` and `Set-Cookie` lines, the VTEX
+ * ID cookie, and `Bearer` tokens.
+ * The rest of the text is kept.
+ *
+ * It is for text that was built from an error, where the error object is no longer there to
+ * detect. It does not inspect anything else: a credential that is neither one of the secrets nor
+ * under one of those names is not found.
+ */
+const redactSecrets = (text, secrets = []) => {
+    const known = redactKnown(text, secrets);
+    let value = known.value;
+    let redacted = known.redacted;
+    for (const pattern of [KEYED_VALUE, HEADER_LINE, COOKIE_LINE, VTEX_ID_COOKIE, BEARER_TOKEN]) {
+        const result = redactPattern(value, pattern);
+        value = result.value;
+        redacted += result.redacted;
+    }
+    return { redacted, value: redacted > 0 ? value : text };
+};
+exports.redactSecrets = redactSecrets;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtex/api",
-  "version": "6.52.1",
+  "version": "6.52.5",
   "description": "VTEX I/O API client",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",