@zappyquote/sdk 0.1.0 → 0.1.1

package/README.md

@@ -4,7 +4,7 @@ The official JavaScript/TypeScript client for the Zappy API v1 - a thin wrapper
 (https://zappyquote.com/developers/). The server stays authoritative for pricing, caps, idempotency and ownership;
 this package only carries requests and maps the public error envelope into typed errors.
 
-Version 0.1.0 · contract `openapi-1.0.0@9dff9fdfbcd8c1bd` · Node 18+ · zero dependencies · types included · MIT
+Version 0.1.1 · contract `openapi-1.0.0@9dff9fdfbcd8c1bd` · Node 18+ · zero dependencies · types included · MIT
 
 ```bash
 # official download (always available):

package/index.d.ts

@@ -55,6 +55,8 @@ export class Zappy {
 export default Zappy;
 
 export function redact(s: string): string;
+/** redact() applied to every string inside a value (objects, arrays). */
+export declare function redactDeep<T = unknown>(v: T): T;
 export function newIdempotencyKey(prefix?: string): string;
 export function verifyWebhookSignature(secret: string, header: string, rawBody: string | Uint8Array, opts?: { now?: number; windowSeconds?: number }): boolean;
 export function pkcePair(): { verifier: string; challenge: string; method: 'S256' };

package/index.mjs

@@ -14,14 +14,21 @@
  */
 import { createHash, randomBytes, timingSafeEqual, createHmac } from 'node:crypto';
 
-export const SDK_VERSION = '0.1.0';
+export const SDK_VERSION = '0.1.1';
 /** sha256 prefix of the public_html/api/openapi.json this client was written against (see DEVELOPER_DISTRIBUTION.md). */
 export const CONTRACT = 'openapi-1.0.0@9dff9fdfbcd8c1bd';
 export const DEFAULT_BASE_URL = 'https://zappyquote.com/api/v1';
 
-const KEY_RE = /(zp_live_|zat_|zrt_|zcs_)[A-Za-z0-9_-]+/g;   // no leading boundary: an embedded credential is still a credential
+const KEY_RE = /(zp_live_|zat_|zrt_|zcs_|whsec_)[A-Za-z0-9_-]+/g;   // no leading boundary: an embedded credential is still a credential
 /** Replace any Zappy credential shape in a string with a redacted marker. Used on every error message and log line. */
 export function redact(s) { return String(s).replace(KEY_RE, (m, p) => p + '…redacted'); }
+/** redact() applied to every string inside a value (objects, arrays), depth-bounded - for error bodies and metadata (F6-SEC-001). */
+export function redactDeep(v, depth = 0) {
+  if (typeof v === 'string') return redact(v);
+  if (v === null || typeof v !== 'object' || depth > 8) return (v !== null && typeof v === 'object') ? null : v;
+  if (Array.isArray(v)) return v.map(x => redactDeep(x, depth + 1));
+  const o = {}; for (const [k, x] of Object.entries(v)) o[redact(k)] = redactDeep(x, depth + 1); return o;
+}
 
 /** A stable idempotency key for ONE intended operation. Keep it with the operation and reuse it to replay safely. */
 export function newIdempotencyKey(prefix = 'zq') {
@@ -32,8 +39,8 @@ export function newIdempotencyKey(prefix = 'zq') {
 export class ZappyError extends Error {
   constructor(message, { code = 'error', status = 0, requestId = null, rateLimit = null, retryAfter = null, body = null } = {}) {
     super(redact(message));
-    this.name = 'ZappyError'; this.code = code; this.status = status; this.requestId = requestId;
-    this.rateLimit = rateLimit; this.retryAfter = retryAfter; this.body = body;
+    this.name = 'ZappyError'; this.code = redact(code); this.status = status; this.requestId = requestId == null ? null : redact(requestId);
+    this.rateLimit = rateLimit; this.retryAfter = retryAfter; this.body = redactDeep(body);   // F6-SEC-001: no credential survives in a serialized error
   }
 }
 export class ZappyAuthError extends ZappyError { constructor(m, o) { super(m, o); this.name = 'ZappyAuthError'; } }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zappyquote/sdk",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Official Zappy API client for JavaScript/TypeScript - a thin wrapper over the documented Zappy API v1.",
   "keywords": ["zappy", "ai", "image-generation", "api", "sdk"],
   "homepage": "https://zappyquote.com/developers/",