auth0 7.5.0-beta.0 → 7.6.0

package/dist/cjs/management/core/fetcher/Fetcher.js

@@ -22,7 +22,9 @@ const getResponseBody_js_1 = require("./getResponseBody.js");
 const Headers_js_1 = require("./Headers.js");
 const makeRequest_js_1 = require("./makeRequest.js");
 const RawResponse_js_1 = require("./RawResponse.js");
+const redactUrl_js_1 = require("./redactUrl.js");
 const requestWithRetries_js_1 = require("./requestWithRetries.js");
+const signals_js_1 = require("./signals.js");
 const SENSITIVE_HEADERS = new Set([
     "authorization",
     "www-authenticate",
@@ -53,100 +55,16 @@ function redactHeaders(headers) {
     }
     return filtered;
 }
-const SENSITIVE_QUERY_PARAMS = new Set([
-    "api_key",
-    "api-key",
-    "apikey",
-    "token",
-    "access_token",
-    "access-token",
-    "auth_token",
-    "auth-token",
-    "password",
-    "passwd",
-    "secret",
-    "api_secret",
-    "api-secret",
-    "apisecret",
-    "key",
-    "session",
-    "session_id",
-    "session-id",
-]);
 function redactQueryParameters(queryParameters) {
     if (queryParameters == null) {
         return undefined;
     }
     const redacted = {};
     for (const [key, value] of Object.entries(queryParameters)) {
-        redacted[key] = SENSITIVE_QUERY_PARAMS.has(key.toLowerCase()) ? "[REDACTED]" : value;
+        redacted[key] = redactUrl_js_1.SENSITIVE_QUERY_PARAMS.has(key.toLowerCase()) ? "[REDACTED]" : value;
     }
     return redacted;
 }
-function redactUrl(url) {
-    const protocolIndex = url.indexOf("://");
-    if (protocolIndex === -1)
-        return url;
-    const afterProtocol = protocolIndex + 3;
-    // Find the first delimiter that marks the end of the authority section
-    const pathStart = url.indexOf("/", afterProtocol);
-    let queryStart = url.indexOf("?", afterProtocol);
-    let fragmentStart = url.indexOf("#", afterProtocol);
-    const firstDelimiter = Math.min(pathStart === -1 ? url.length : pathStart, queryStart === -1 ? url.length : queryStart, fragmentStart === -1 ? url.length : fragmentStart);
-    // Find the LAST @ before the delimiter (handles multiple @ in credentials)
-    let atIndex = -1;
-    for (let i = afterProtocol; i < firstDelimiter; i++) {
-        if (url[i] === "@") {
-            atIndex = i;
-        }
-    }
-    if (atIndex !== -1) {
-        url = `${url.slice(0, afterProtocol)}[REDACTED]@${url.slice(atIndex + 1)}`;
-    }
-    // Recalculate queryStart since url might have changed
-    queryStart = url.indexOf("?");
-    if (queryStart === -1)
-        return url;
-    fragmentStart = url.indexOf("#", queryStart);
-    const queryEnd = fragmentStart !== -1 ? fragmentStart : url.length;
-    const queryString = url.slice(queryStart + 1, queryEnd);
-    if (queryString.length === 0)
-        return url;
-    // FAST PATH: Quick check if any sensitive keywords present
-    // Using indexOf is faster than regex for simple substring matching
-    const lower = queryString.toLowerCase();
-    const hasSensitive = lower.includes("token") ||
-        lower.includes("key") ||
-        lower.includes("password") ||
-        lower.includes("passwd") ||
-        lower.includes("secret") ||
-        lower.includes("session") ||
-        lower.includes("auth");
-    if (!hasSensitive) {
-        return url;
-    }
-    // SLOW PATH: Parse and redact
-    const redactedParams = [];
-    const params = queryString.split("&");
-    for (const param of params) {
-        const equalIndex = param.indexOf("=");
-        if (equalIndex === -1) {
-            redactedParams.push(param);
-            continue;
-        }
-        const key = param.slice(0, equalIndex);
-        let shouldRedact = SENSITIVE_QUERY_PARAMS.has(key.toLowerCase());
-        if (!shouldRedact && key.includes("%")) {
-            try {
-                const decodedKey = decodeURIComponent(key);
-                shouldRedact = SENSITIVE_QUERY_PARAMS.has(decodedKey.toLowerCase());
-            }
-            catch (_a) { }
-        }
-        redactedParams.push(shouldRedact ? `${key}=[REDACTED]` : param);
-    }
-    return url.slice(0, queryStart + 1) + redactedParams.join("&") + url.slice(queryEnd);
-}
 function getHeaders(args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
@@ -178,6 +96,11 @@ function getHeaders(args) {
         return newHeaders;
     });
 }
+function isJsonContentType(contentType) {
+    var _a, _b;
+    const mediaType = (_b = (_a = contentType === null || contentType === void 0 ? void 0 : contentType.split(";")[0]) === null || _a === void 0 ? void 0 : _a.trim().toLowerCase()) !== null && _b !== void 0 ? _b : "";
+    return mediaType === "application/json" || mediaType === "text/json" || mediaType.endsWith("+json");
+}
 function fetcherImpl(args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c;
@@ -198,28 +121,47 @@ function fetcherImpl(args) {
         if (logger.isDebug()) {
             const metadata = {
                 method: args.method,
-                url: redactUrl(url),
+                url: (0, redactUrl_js_1.redactUrl)(url),
                 headers: redactHeaders(headers),
                 queryParameters: redactQueryParameters(args.queryParameters),
                 hasBody: requestBody != null,
             };
             logger.debug("Making HTTP request", metadata);
         }
+        // Bodies that are read in full here stay covered by the timeout; streamed bodies are read by the caller.
+        const keepTimeoutUntilBodyRead = args.responseType !== "streaming" && args.responseType !== "sse" && args.responseType !== "binary-response";
+        const attemptResponses = [];
         try {
             const response = yield (0, requestWithRetries_js_1.requestWithRetries)(() => __awaiter(this, void 0, void 0, function* () {
-                return (0, makeRequest_js_1.makeRequest)(fetchFn, url, args.method, headers, requestBody, args.timeoutMs, args.abortSignal, args.withCredentials, args.duplex, args.responseType === "streaming" || args.responseType === "sse");
-            }), args.maxRetries);
+                // A retry means the previous attempt is over; stop its timer now rather than at the end.
+                for (const previousResponse of attemptResponses) {
+                    (0, makeRequest_js_1.clearResponseTimeout)(previousResponse);
+                }
+                const attemptResponse = yield (0, makeRequest_js_1.makeRequest)(fetchFn, url, args.method, headers, requestBody, args.timeoutMs, args.abortSignal, args.withCredentials, args.duplex, args.responseType === "streaming" || args.responseType === "sse", keepTimeoutUntilBodyRead);
+                attemptResponses.push(attemptResponse);
+                return attemptResponse;
+            }), args.maxRetries, args.abortSignal);
             if (response.status >= 200 && response.status < 400) {
                 if (logger.isDebug()) {
                     const metadata = {
                         method: args.method,
-                        url: redactUrl(url),
+                        url: (0, redactUrl_js_1.redactUrl)(url),
                         statusCode: response.status,
                         responseHeaders: redactHeaders(response.headers),
                     };
                     logger.debug("HTTP request succeeded", metadata);
                 }
                 const body = yield (0, getResponseBody_js_1.getResponseBody)(response, args.responseType);
+                // Only a body the server labelled as JSON is an error here; void endpoints may return plain text.
+                if ((0, getResponseBody_js_1.isResponseBodyError)(body) &&
+                    body.error.reason === "non-json" &&
+                    isJsonContentType(response.headers.get("Content-Type"))) {
+                    return {
+                        ok: false,
+                        error: body.error,
+                        rawResponse: (0, RawResponse_js_1.toRawResponse)(response),
+                    };
+                }
                 return {
                     ok: true,
                     body: body,
@@ -231,7 +173,7 @@ function fetcherImpl(args) {
                 if (logger.isError()) {
                     const metadata = {
                         method: args.method,
-                        url: redactUrl(url),
+                        url: (0, redactUrl_js_1.redactUrl)(url),
                         statusCode: response.status,
                         responseHeaders: redactHeaders(Object.fromEntries(response.headers.entries())),
                     };
@@ -253,7 +195,7 @@ function fetcherImpl(args) {
                 if (logger.isError()) {
                     const metadata = {
                         method: args.method,
-                        url: redactUrl(url),
+                        url: (0, redactUrl_js_1.redactUrl)(url),
                     };
                     logger.error("HTTP request was aborted", metadata);
                 }
@@ -267,11 +209,11 @@ function fetcherImpl(args) {
                     rawResponse: RawResponse_js_1.abortRawResponse,
                 };
             }
-            else if (error instanceof Error && error.name === "AbortError") {
+            else if (error === signals_js_1.TIMEOUT || (error instanceof Error && error.name === "AbortError")) {
                 if (logger.isError()) {
                     const metadata = {
                         method: args.method,
-                        url: redactUrl(url),
+                        url: (0, redactUrl_js_1.redactUrl)(url),
                         timeoutMs: args.timeoutMs,
                     };
                     logger.error("HTTP request timed out", metadata);
@@ -289,7 +231,7 @@ function fetcherImpl(args) {
                 if (logger.isError()) {
                     const metadata = {
                         method: args.method,
-                        url: redactUrl(url),
+                        url: (0, redactUrl_js_1.redactUrl)(url),
                         errorMessage: error.message,
                     };
                     logger.error("HTTP request failed with error", metadata);
@@ -307,7 +249,7 @@ function fetcherImpl(args) {
             if (logger.isError()) {
                 const metadata = {
                     method: args.method,
-                    url: redactUrl(url),
+                    url: (0, redactUrl_js_1.redactUrl)(url),
                     error: (0, json_js_1.toJson)(error),
                 };
                 logger.error("HTTP request failed with unknown error", metadata);
@@ -322,6 +264,11 @@ function fetcherImpl(args) {
                 rawResponse: RawResponse_js_1.unknownRawResponse,
             };
         }
+        finally {
+            for (const attemptResponse of attemptResponses) {
+                (0, makeRequest_js_1.clearResponseTimeout)(attemptResponse);
+            }
+        }
     });
 }
 exports.fetcher = fetcherImpl;

package/dist/cjs/management/core/fetcher/getErrorResponseBody.js

@@ -12,12 +12,28 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getErrorResponseBody = getErrorResponseBody;
 const json_js_1 = require("../json.js");
 const getResponseBody_js_1 = require("./getResponseBody.js");
+/** Parses a JSON error body, falling back to the raw text so the status and body are never lost. */
+function parseJsonErrorBody(text) {
+    if (text.length === 0) {
+        return undefined;
+    }
+    try {
+        return (0, json_js_1.fromJson)(text);
+    }
+    catch (_a) {
+        return text;
+    }
+}
 function getErrorResponseBody(response) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c;
         let contentType = (_a = response.headers.get("Content-Type")) === null || _a === void 0 ? void 0 : _a.toLowerCase();
         if (contentType == null || contentType.length === 0) {
-            return (0, getResponseBody_js_1.getResponseBody)(response);
+            const body = yield (0, getResponseBody_js_1.getResponseBody)(response);
+            if ((0, getResponseBody_js_1.isResponseBodyError)(body)) {
+                return body.error.reason === "non-json" ? body.error.rawBody : undefined;
+            }
+            return body;
         }
         if (contentType.indexOf(";") !== -1) {
             contentType = (_c = (_b = contentType.split(";")[0]) === null || _b === void 0 ? void 0 : _b.trim()) !== null && _c !== void 0 ? _c : "";
@@ -28,14 +44,11 @@ function getErrorResponseBody(response) {
             case "application/ld+json":
             case "application/problem+json":
             case "application/vnd.api+json":
-            case "text/json": {
-                const text = yield response.text();
-                return text.length > 0 ? (0, json_js_1.fromJson)(text) : undefined;
-            }
+            case "text/json":
+                return parseJsonErrorBody(yield response.text());
             default:
                 if (contentType.startsWith("application/vnd.") && contentType.endsWith("+json")) {
-                    const text = yield response.text();
-                    return text.length > 0 ? (0, json_js_1.fromJson)(text) : undefined;
+                    return parseJsonErrorBody(yield response.text());
                 }
                 // Fallback to plain text if content type is not recognized
                 // Even if no body is present, the response will be an empty string

package/dist/cjs/management/core/fetcher/getResponseBody.d.ts

@@ -1 +1,17 @@
+export type ResponseBodyError = {
+    ok: false;
+    error: {
+        reason: "non-json";
+        statusCode: number;
+        rawBody: string;
+    } | {
+        reason: "body-is-null";
+        statusCode: number;
+    };
+};
+/**
+ * Returns true when `value` is a failure record created by `getResponseBody` (for example malformed JSON),
+ * as opposed to a parsed JSON body that happens to have the same shape.
+ */
+export declare function isResponseBodyError(value: unknown): value is ResponseBodyError;
 export declare function getResponseBody(response: Response, responseType?: string): Promise<unknown>;

package/dist/cjs/management/core/fetcher/getResponseBody.js

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isResponseBodyError = isResponseBodyError;
 exports.getResponseBody = getResponseBody;
 const json_js_1 = require("../json.js");
 const BinaryResponse_js_1 = require("./BinaryResponse.js");
@@ -21,6 +22,19 @@ function retainResponse(target, response) {
         writable: false,
     });
 }
+const responseBodyErrors = new WeakSet();
+function responseBodyError(error) {
+    const record = { ok: false, error };
+    responseBodyErrors.add(record);
+    return record;
+}
+/**
+ * Returns true when `value` is a failure record created by `getResponseBody` (for example malformed JSON),
+ * as opposed to a parsed JSON body that happens to have the same shape.
+ */
+function isResponseBodyError(value) {
+    return typeof value === "object" && value != null && responseBodyErrors.has(value);
+}
 function getResponseBody(response, responseType) {
     return __awaiter(this, void 0, void 0, function* () {
         switch (responseType) {
@@ -32,25 +46,19 @@ function getResponseBody(response, responseType) {
                 return yield response.arrayBuffer();
             case "sse":
                 if (response.body == null) {
-                    return {
-                        ok: false,
-                        error: {
-                            reason: "body-is-null",
-                            statusCode: response.status,
-                        },
-                    };
+                    return responseBodyError({
+                        reason: "body-is-null",
+                        statusCode: response.status,
+                    });
                 }
                 retainResponse(response.body, response);
                 return response.body;
             case "streaming":
                 if (response.body == null) {
-                    return {
-                        ok: false,
-                        error: {
-                            reason: "body-is-null",
-                            statusCode: response.status,
-                        },
-                    };
+                    return responseBodyError({
+                        reason: "body-is-null",
+                        statusCode: response.status,
+                    });
                 }
                 retainResponse(response.body, response);
                 return response.body;
@@ -65,14 +73,11 @@ function getResponseBody(response, responseType) {
                 return responseBody;
             }
             catch (_err) {
-                return {
-                    ok: false,
-                    error: {
-                        reason: "non-json",
-                        statusCode: response.status,
-                        rawBody: text,
-                    },
-                };
+                return responseBodyError({
+                    reason: "non-json",
+                    statusCode: response.status,
+                    rawBody: text,
+                });
             }
         }
         return undefined;

package/dist/cjs/management/core/fetcher/makePassthroughRequest.js

@@ -15,7 +15,9 @@ const join_js_1 = require("../url/join.js");
 const EndpointSupplier_js_1 = require("./EndpointSupplier.js");
 const getFetchFn_js_1 = require("./getFetchFn.js");
 const makeRequest_js_1 = require("./makeRequest.js");
+const redactUrl_js_1 = require("./redactUrl.js");
 const requestWithRetries_js_1 = require("./requestWithRetries.js");
+const signals_js_1 = require("./signals.js");
 const Supplier_js_1 = require("./Supplier.js");
 /**
  * Makes a passthrough HTTP request using the SDK's configuration (auth, retry, logging, etc.)
@@ -79,8 +81,10 @@ function makePassthroughRequest(input, init, clientOptions, requestOptions) {
                 }
             }
         }
-        // Apply auth headers
-        if (clientOptions.getAuthHeaders != null) {
+        // Apply auth headers, but only when the resolved URL targets the configured base URL.
+        // This prevents the SDK's credentials from leaking to an unrelated host when a caller
+        // passes an absolute cross-origin URL into the passthrough fetch escape hatch.
+        if (clientOptions.getAuthHeaders != null && targetsBaseUrl(fullUrl, baseUrl)) {
             const authHeaders = yield clientOptions.getAuthHeaders();
             for (const [key, value] of Object.entries(authHeaders)) {
                 mergedHeaders[key.toLowerCase()] = value;
@@ -115,21 +119,55 @@ function makePassthroughRequest(input, init, clientOptions, requestOptions) {
         if (logger.isDebug()) {
             logger.debug("Making passthrough HTTP request", {
                 method,
-                url: fullUrl,
+                url: (0, redactUrl_js_1.redactUrl)(fullUrl),
                 hasBody: body != null,
             });
         }
-        const response = yield (0, requestWithRetries_js_1.requestWithRetries)(() => __awaiter(this, void 0, void 0, function* () {
-            return (0, makeRequest_js_1.makeRequest)(fetchFn, fullUrl, method, mergedHeaders, body !== null && body !== void 0 ? body : undefined, timeoutMs, abortSignal, (effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.credentials) === "include", undefined, // duplex
-            false);
-        }), maxRetries);
+        let response;
+        try {
+            response = yield (0, requestWithRetries_js_1.requestWithRetries)(() => __awaiter(this, void 0, void 0, function* () {
+                return (0, makeRequest_js_1.makeRequest)(fetchFn, fullUrl, method, mergedHeaders, body !== null && body !== void 0 ? body : undefined, timeoutMs, abortSignal, (effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.credentials) === "include", undefined, // duplex
+                false);
+            }), maxRetries, abortSignal);
+        }
+        catch (error) {
+            // Match `fetch`: a timeout rejects with an Error named "TimeoutError", not the bare abort reason.
+            if (error === signals_js_1.TIMEOUT) {
+                throw createTimeoutError();
+            }
+            throw error;
+        }
         if (logger.isDebug()) {
             logger.debug("Passthrough HTTP request completed", {
                 method,
-                url: fullUrl,
+                url: (0, redactUrl_js_1.redactUrl)(fullUrl),
                 statusCode: response.status,
             });
         }
         return response;
     });
 }
+function createTimeoutError() {
+    const error = new Error("The request timed out.");
+    error.name = "TimeoutError";
+    return error;
+}
+/**
+ * Returns true when the resolved request URL points at the same origin as the
+ * configured base URL. Relative paths are always joined onto the base URL, so
+ * they resolve to the base origin and return true. Absolute URLs only match when
+ * their origin equals the base origin. When there is no base URL to compare
+ * against, or either value is not a parseable absolute URL, this returns false so
+ * auth headers are not attached.
+ */
+function targetsBaseUrl(fullUrl, baseUrl) {
+    if (baseUrl == null) {
+        return false;
+    }
+    try {
+        return new URL(fullUrl).origin === new URL(baseUrl).origin;
+    }
+    catch (_a) {
+        return false;
+    }
+}

package/dist/cjs/management/core/fetcher/makeRequest.d.ts

@@ -3,4 +3,9 @@ export declare function isCacheNoStoreSupported(): boolean;
  * Reset the cached result of `isCacheNoStoreSupported`. Exposed for testing only.
  */
 export declare function resetCacheNoStoreSupported(): void;
-export declare const makeRequest: (fetchFn: (url: string, init: RequestInit) => Promise<Response>, url: string, method: string, headers: Headers | Record<string, string>, requestBody: BodyInit | undefined, timeoutMs?: number, abortSignal?: AbortSignal, withCredentials?: boolean, duplex?: "half", disableCache?: boolean) => Promise<Response>;
+/**
+ * Clears the timeout that `makeRequest` kept running (with `keepTimeoutUntilBodyRead`) so that it also
+ * covered reading the response body.
+ */
+export declare function clearResponseTimeout(response: Response): void;
+export declare const makeRequest: (fetchFn: (url: string, init: RequestInit) => Promise<Response>, url: string, method: string, headers: Headers | Record<string, string>, requestBody: BodyInit | undefined, timeoutMs?: number, abortSignal?: AbortSignal, withCredentials?: boolean, duplex?: "half", disableCache?: boolean, keepTimeoutUntilBodyRead?: boolean) => Promise<Response>;

package/dist/cjs/management/core/fetcher/makeRequest.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.makeRequest = void 0;
 exports.isCacheNoStoreSupported = isCacheNoStoreSupported;
 exports.resetCacheNoStoreSupported = resetCacheNoStoreSupported;
+exports.clearResponseTimeout = clearResponseTimeout;
 const signals_js_1 = require("./signals.js");
 /**
  * Cached result of checking whether the current runtime supports
@@ -38,23 +39,55 @@ function isCacheNoStoreSupported() {
 function resetCacheNoStoreSupported() {
     _cacheNoStoreSupported = undefined;
 }
-const makeRequest = (fetchFn, url, method, headers, requestBody, timeoutMs, abortSignal, withCredentials, duplex, disableCache) => __awaiter(void 0, void 0, void 0, function* () {
+const responseTimeouts = new WeakMap();
+/**
+ * Clears the timeout that `makeRequest` kept running (with `keepTimeoutUntilBodyRead`) so that it also
+ * covered reading the response body.
+ */
+function clearResponseTimeout(response) {
+    const timeoutId = responseTimeouts.get(response);
+    if (timeoutId != null) {
+        clearTimeout(timeoutId);
+        responseTimeouts.delete(response);
+    }
+}
+const makeRequest = (fetchFn, url, method, headers, requestBody, timeoutMs, abortSignal, withCredentials, duplex, disableCache, keepTimeoutUntilBodyRead) => __awaiter(void 0, void 0, void 0, function* () {
     const signals = [];
     let timeoutAbortId;
+    let timeoutSignal;
     if (timeoutMs != null) {
         const { signal, abortId } = (0, signals_js_1.getTimeoutSignal)(timeoutMs);
         timeoutAbortId = abortId;
+        timeoutSignal = signal;
         signals.push(signal);
     }
     if (abortSignal != null) {
         signals.push(abortSignal);
     }
     const newSignals = (0, signals_js_1.anySignal)(signals);
-    const response = yield fetchFn(url, Object.assign({ method: method, headers, body: requestBody, signal: newSignals, credentials: withCredentials ? "include" : undefined, 
-        // @ts-ignore
-        duplex }, (disableCache && isCacheNoStoreSupported() ? { cache: "no-store" } : {})));
+    let response;
+    try {
+        response = yield fetchFn(url, Object.assign({ method: method, headers, body: requestBody, signal: newSignals, credentials: withCredentials ? "include" : undefined, 
+            // @ts-ignore
+            duplex }, (disableCache && isCacheNoStoreSupported() ? { cache: "no-store" } : {})));
+    }
+    catch (error) {
+        if (timeoutAbortId != null) {
+            clearTimeout(timeoutAbortId);
+        }
+        // Some runtimes (e.g. Node 18) reject with their own error instead of the abort reason.
+        if ((timeoutSignal === null || timeoutSignal === void 0 ? void 0 : timeoutSignal.aborted) && !(abortSignal === null || abortSignal === void 0 ? void 0 : abortSignal.aborted)) {
+            throw signals_js_1.TIMEOUT;
+        }
+        throw error;
+    }
     if (timeoutAbortId != null) {
-        clearTimeout(timeoutAbortId);
+        if (keepTimeoutUntilBodyRead) {
+            responseTimeouts.set(response, timeoutAbortId);
+        }
+        else {
+            clearTimeout(timeoutAbortId);
+        }
     }
     return response;
 });

package/dist/cjs/management/core/fetcher/redactUrl.d.ts

@@ -0,0 +1,2 @@
+export declare const SENSITIVE_QUERY_PARAMS: Set<string>;
+export declare function redactUrl(url: string): string;

package/dist/cjs/management/core/fetcher/redactUrl.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_QUERY_PARAMS = void 0;
+exports.redactUrl = redactUrl;
+exports.SENSITIVE_QUERY_PARAMS = new Set([
+    "api_key",
+    "api-key",
+    "apikey",
+    "token",
+    "access_token",
+    "access-token",
+    "auth_token",
+    "auth-token",
+    "password",
+    "passwd",
+    "secret",
+    "api_secret",
+    "api-secret",
+    "apisecret",
+    "key",
+    "session",
+    "session_id",
+    "session-id",
+]);
+function redactUrl(url) {
+    const protocolIndex = url.indexOf("://");
+    if (protocolIndex === -1)
+        return url;
+    const afterProtocol = protocolIndex + 3;
+    // Find the first delimiter that marks the end of the authority section
+    const pathStart = url.indexOf("/", afterProtocol);
+    let queryStart = url.indexOf("?", afterProtocol);
+    let fragmentStart = url.indexOf("#", afterProtocol);
+    const firstDelimiter = Math.min(pathStart === -1 ? url.length : pathStart, queryStart === -1 ? url.length : queryStart, fragmentStart === -1 ? url.length : fragmentStart);
+    // Find the LAST @ before the delimiter (handles multiple @ in credentials)
+    let atIndex = -1;
+    for (let i = afterProtocol; i < firstDelimiter; i++) {
+        if (url[i] === "@") {
+            atIndex = i;
+        }
+    }
+    if (atIndex !== -1) {
+        url = `${url.slice(0, afterProtocol)}[REDACTED]@${url.slice(atIndex + 1)}`;
+    }
+    // Recalculate queryStart since url might have changed
+    queryStart = url.indexOf("?");
+    if (queryStart === -1)
+        return url;
+    fragmentStart = url.indexOf("#", queryStart);
+    const queryEnd = fragmentStart !== -1 ? fragmentStart : url.length;
+    const queryString = url.slice(queryStart + 1, queryEnd);
+    if (queryString.length === 0)
+        return url;
+    // FAST PATH: Quick check if any sensitive keywords present
+    // Using indexOf is faster than regex for simple substring matching
+    const lower = queryString.toLowerCase();
+    const hasSensitive = lower.includes("token") ||
+        lower.includes("key") ||
+        lower.includes("password") ||
+        lower.includes("passwd") ||
+        lower.includes("secret") ||
+        lower.includes("session") ||
+        lower.includes("auth");
+    if (!hasSensitive) {
+        return url;
+    }
+    // SLOW PATH: Parse and redact
+    const redactedParams = [];
+    const params = queryString.split("&");
+    for (const param of params) {
+        const equalIndex = param.indexOf("=");
+        if (equalIndex === -1) {
+            redactedParams.push(param);
+            continue;
+        }
+        const key = param.slice(0, equalIndex);
+        let shouldRedact = exports.SENSITIVE_QUERY_PARAMS.has(key.toLowerCase());
+        if (!shouldRedact && key.includes("%")) {
+            try {
+                const decodedKey = decodeURIComponent(key);
+                shouldRedact = exports.SENSITIVE_QUERY_PARAMS.has(decodedKey.toLowerCase());
+            }
+            catch (_a) { }
+        }
+        redactedParams.push(shouldRedact ? `${key}=[REDACTED]` : param);
+    }
+    return url.slice(0, queryStart + 1) + redactedParams.join("&") + url.slice(queryEnd);
+}

package/dist/cjs/management/core/fetcher/requestWithRetries.d.ts

@@ -1 +1 @@
-export declare function requestWithRetries(requestFn: () => Promise<Response>, maxRetries?: number): Promise<Response>;
+export declare function requestWithRetries(requestFn: () => Promise<Response>, maxRetries?: number, abortSignal?: AbortSignal): Promise<Response>;