browser-debugger-cli 0.13.0 → 0.15.0

package/dist/session/paths.js

@@ -9,7 +9,8 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import { createLogger, logDebugError } from '../ui/logging/index.js';
-import { makeDirectory } from '../utils/directories.js';
+import { dirTrustProblem, makeDirectory, } from '../utils/directories.js';
+import { getErrorMessage } from '../utils/errors.js';
 const log = createLogger('session');
 /**
  * Session file paths relative to ~/.bdg/
@@ -57,12 +58,21 @@ export const SESSION_STATE_FILES = [
  * @returns Full path to the base session directory
  */
 export function getSessionBaseDir() {
-    const override = process.env[SESSION_DIR_OVERRIDE_ENV];
-    if (override && override.trim().length > 0) {
+    const override = sessionDirOverride();
+    if (override !== null) {
         return path.isAbsolute(override) ? override : path.resolve(override);
     }
     return path.join(os.homedir(), '.bdg');
 }
+/**
+ * The base session directory the user chose with `$BDG_SESSION_DIR`.
+ *
+ * @returns The variable's value, or null when unset or blank (`~/.bdg`)
+ */
+function sessionDirOverride() {
+    const override = process.env[SESSION_DIR_OVERRIDE_ENV];
+    return override && override.trim().length > 0 ? override : null;
+}
 /**
  * The selected session name (`--session` / `BDG_SESSION`), lower-cased:
  * session names are case-insensitive.
@@ -163,16 +173,153 @@ export function getSessionFilePath(fileType) {
 export function getDaemonSocketPath() {
     return getSessionFilePath('DAEMON_SOCKET');
 }
+/** Mode of the session directories bdg creates: only the user can enter them */
+const PRIVATE_DIR_MODE = 0o700;
+/** Permission bits that give group or others any access */
+const GROUP_OTHER_ACCESS = 0o077;
 /**
  * Ensure the session directory exists.
  *
- * Creates ~/.bdg/ if it doesn't exist. Safe to call multiple times (idempotent).
- * A path that cannot hold a directory is refused before `mkdir`, which
- * would spin on a pseudo-filesystem ({@link makeDirectory}).
+ * Creates it, and missing parents (the base directory, `sessions/`), with
+ * mode 0700. Safe to call multiple times (idempotent). A path that cannot
+ * hold a directory is refused before `mkdir`, which would spin on a
+ * pseudo-filesystem ({@link makeDirectory}).
  *
  * @throws Error if the directory cannot be created
  */
 export function ensureSessionDir() {
-    makeDirectory(getSessionDir());
+    makeDirectory(getSessionDir(), PRIVATE_DIR_MODE);
+}
+/** Session directories need not keep group write out (umask 002 made them 0775) */
+const SESSION_DIR_TRUST = { allowGroupWrite: true };
+/**
+ * Directories whose trust a session directory depends on: the base
+ * directory and each directory from it down to the session directory
+ * (`<base>`, `<base>/sessions`, `<base>/sessions/<name>`), or the directory
+ * alone when it is outside the base.
+ *
+ * @param dir - Session directory
+ * @returns Directories, outermost first
+ */
+function sessionDirChain(dir) {
+    const base = getSessionBaseDir();
+    const relative = path.relative(base, dir);
+    if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        return [{ dir, bdgOwned: false, isBase: false }];
+    }
+    const chain = [{ dir: base, bdgOwned: sessionDirOverride() === null, isBase: true }];
+    let current = base;
+    for (const part of relative.split(path.sep).filter(Boolean)) {
+        current = path.join(current, part);
+        chain.push({ dir: current, bdgOwned: true, isBase: false });
+    }
+    return chain;
+}
+/**
+ * Remove group and other access from a directory of the user's (best
+ * effort). The directory is opened without following a symlink and changed
+ * through that descriptor, so a path swapped after the trust check is not
+ * affected.
+ *
+ * @param dir - Trusted directory
+ */
+function tightenDir(dir) {
+    if (process.platform === 'win32')
+        return;
+    let fd;
+    try {
+        const { O_RDONLY, O_DIRECTORY, O_NOFOLLOW } = fs.constants;
+        fd = fs.openSync(dir, O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
+        const stat = fs.fstatSync(fd);
+        if (stat.uid !== process.getuid?.() || (stat.mode & GROUP_OTHER_ACCESS) === 0)
+            return;
+        fs.fchmodSync(fd, PRIVATE_DIR_MODE);
+        log.debug(`Session directory ${dir} restricted to mode 700`);
+    }
+    catch (error) {
+        log.debug(`Session directory ${dir} not restricted: ${getErrorMessage(error)}`);
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
+/**
+ * Why a directory of the chain cannot be trusted. The base directory alone
+ * may be a symlink (`~/.bdg` kept with dotfiles or on another disk): its
+ * target is checked instead. `sessions/` and session directories must be
+ * real directories.
+ *
+ * @param entry - Directory of the chain
+ * @returns The problem, or null when it can be trusted
+ * @throws Error from `lstat`/`realpath` (e.g. `ENOENT`)
+ */
+function chainDirProblem(entry) {
+    const problem = dirTrustProblem(entry.dir, SESSION_DIR_TRUST);
+    if (problem?.kind !== 'symlink' || !entry.isBase)
+        return problem;
+    const target = fs.realpathSync(entry.dir);
+    const targetProblem = dirTrustProblem(target, SESSION_DIR_TRUST);
+    return (targetProblem && {
+        ...targetProblem,
+        reason: `it links to ${target}, which is ${targetProblem.reason}`,
+    });
+}
+/**
+ * Accept a trusted directory: tighten it to 0700 when bdg owns it, leave a
+ * directory the user chose as it is (noted in the debug log when group or
+ * others can use it).
+ *
+ * @param entry - Trusted directory
+ */
+function acceptTrustedDir(entry) {
+    if (entry.bdgOwned) {
+        tightenDir(entry.dir);
+        return;
+    }
+    const mode = fs.statSync(entry.dir, { throwIfNoEntry: false })?.mode ?? 0;
+    if ((mode & GROUP_OTHER_ACCESS) === 0)
+        return;
+    log.debug(`Session directory ${entry.dir} is open to group or others; left as is (chosen with ${SESSION_DIR_OVERRIDE_ENV})`);
+}
+/**
+ * Check that a session directory and the directories above it up to the base
+ * directory can be trusted before a daemon is started there or its socket is
+ * connected to: another user who can write to one of them could replace the
+ * socket (and receive every command) or plant files. Each existing directory
+ * must be a real directory (not a symlink), owned by the user, and not
+ * writable by others ({@link dirTrustProblem}); group write is accepted, since
+ * under umask 002 (per-user groups) older versions created `~/.bdg` 0775.
+ * The base directory may be a symlink whose target passes the same rule
+ * ({@link chainDirProblem}). A directory owned by another uid (a bind mount,
+ * `sudo -E`) is refused.
+ *
+ * Trusted directories bdg owns (the default `~/.bdg`, `sessions/` and named
+ * session directories) that group or others can still use are tightened to
+ * 0700; a base directory chosen with `$BDG_SESSION_DIR`, or a symlinked base
+ * (opened without following links), is never changed.
+ * Missing paths are skipped (as is a path through a file, which fails on its
+ * own): {@link ensureSessionDir} creates them 0700.
+ *
+ * @param dir - Session directory (default: the selected session's)
+ * @returns The first untrusted directory and why, or null
+ */
+export function secureSessionDir(dir = getSessionDir()) {
+    for (const entry of sessionDirChain(dir)) {
+        let problem;
+        try {
+            problem = chainDirProblem(entry);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 'ENOENT' || code === 'ENOTDIR')
+                continue;
+            problem = { reason: getErrorMessage(error), kind: 'not-directory' };
+        }
+        if (problem !== null)
+            return { dir: entry.dir, ...problem, bdgOwned: entry.bdgOwned };
+        acceptTrustedDir(entry);
+    }
+    return null;
 }
 //# sourceMappingURL=paths.js.map

package/dist/session/portClaims.d.ts

@@ -30,14 +30,6 @@ export declare function readPortFile(portPath: string): number | null;
  * @returns `$BDG_PORT_REGISTRY_DIR`, else `<os temp dir>/bdg-ports-<uid>`
  */
 export declare function getPortRegistryDir(): string;
-/**
- * Whether a path is a directory the current user can trust: a real directory
- * (not a symlink), owned by the user, not writable by group or others.
- *
- * @param dir - Directory
- * @returns Why it cannot be trusted, or null if it can
- */
-export declare function untrustedDirReason(dir: string): string | null;
 /**
  * Session directories other than the selected one that bdg knows of: those of
  * this base directory, and those of any base directory found in the

package/dist/session/portClaims.js

@@ -20,7 +20,7 @@ import * as path from 'path';
 import { getSessionBaseDir, getSessionDir, listSessionDirs, sessionFilePathIn, } from './paths.js';
 import { createLogger, logDebugError } from '../ui/logging/index.js';
 import { delay } from '../utils/async.js';
-import { makeDirectory } from '../utils/directories.js';
+import { makeDirectory, untrustedDirReason } from '../utils/directories.js';
 const log = createLogger('session');
 /** Lock file guarding port selection, in the port registry (or base session) directory */
 const PORT_LOCK_FILE = 'port.lock';
@@ -33,8 +33,6 @@ const LOCK_WAIT_MS = 5000;
 /** Lock age after which its holder is assumed dead */
 const STALE_LOCK_MS = 10000;
 const LOCK_POLL_MS = 25;
-/** Permission bits that let other users write */
-const GROUP_OTHER_WRITE = 0o022;
 /**
  * Read a port number from a `port.txt` file.
  *
@@ -64,25 +62,6 @@ export function getPortRegistryDir() {
     const uid = process.getuid?.();
     return path.join(os.tmpdir(), uid === undefined ? 'bdg-ports' : `bdg-ports-${uid}`);
 }
-/**
- * Whether a path is a directory the current user can trust: a real directory
- * (not a symlink), owned by the user, not writable by group or others.
- *
- * @param dir - Directory
- * @returns Why it cannot be trusted, or null if it can
- */
-export function untrustedDirReason(dir) {
-    const stat = fs.lstatSync(dir);
-    if (!stat.isDirectory())
-        return 'not a directory';
-    const uid = process.getuid?.();
-    if (uid !== undefined && stat.uid !== uid)
-        return `owned by uid ${stat.uid}`;
-    if (process.platform !== 'win32' && (stat.mode & GROUP_OTHER_WRITE) !== 0) {
-        return `writable by others (mode ${(stat.mode & 0o777).toString(8)})`;
-    }
-    return null;
-}
 /**
  * The port registry directory, created (mode 0700) if missing, if it can be
  * trusted (see {@link untrustedDirReason}).

package/dist/session/sessionList.d.ts

@@ -11,8 +11,10 @@ import { type SessionDirEntry } from './paths.js';
  * `unresponsive`), died and left its Chrome running (`crashed`) or only
  * files (`stale`), or exited after the session ended without `bdg stop`
  * (`ended`: Chrome crashed or was closed, the page was closed, `--timeout`).
+ * `untrusted`: something listens on its socket, but its directory is not
+ * safe to use, so it is not asked.
  */
-export type RunningSessionState = 'active' | 'starting' | 'ending' | 'unresponsive' | 'crashed' | 'stale' | 'ended';
+export type RunningSessionState = 'active' | 'starting' | 'ending' | 'unresponsive' | 'crashed' | 'stale' | 'ended' | 'untrusted';
 /**
  * One session in the list.
  */
@@ -33,6 +35,8 @@ export interface RunningSessionInfo {
     endReason?: UnexpectedEndReason;
     /** When an `ended` session ended (epoch ms) */
     endedAt?: number;
+    /** Why an `untrusted` session's directory is not safe to use */
+    untrusted?: string;
 }
 /**
  * Summarize a daemon's status response.

package/dist/session/sessionList.js

@@ -7,7 +7,7 @@ import { getStatus } from '../ipc/client.js';
 import { isSessionChrome, readLiveDaemonPid } from './cleanup/staleSession.js';
 import { probeDaemonSocket } from './daemonSocket.js';
 import { readLastSessionEnd } from './lastSession.js';
-import { SESSION_STATE_FILES, getNamedSessionDir, listSessionDirs, sessionFilePathIn, } from './paths.js';
+import { SESSION_STATE_FILES, getNamedSessionDir, listSessionDirs, secureSessionDir, sessionFilePathIn, } from './paths.js';
 import { readPidFromFile } from './pid.js';
 import { readPortFile } from './portClaims.js';
 import { isValidSessionName, normalizeSessionName } from './sessionName.js';
@@ -48,6 +48,10 @@ async function describeSession(entry) {
     const probe = await probeDaemonSocket(socketPath);
     if (probe !== 'alive')
         return describeWithoutSocket(entry, probe);
+    const untrusted = secureSessionDir(dir);
+    if (untrusted) {
+        return { name, state: 'untrusted', untrusted: `${untrusted.dir}: ${untrusted.reason}` };
+    }
     try {
         const response = await getStatus(socketPath);
         if (response.status === 'ok' && response.data)

package/dist/telemetry/a11y.d.ts

@@ -1,5 +1,5 @@
 import type { Protocol } from '../connection/typed-cdp.js';
-import type { A11yNode, A11yTree, A11yQueryPattern, A11yQueryResult, NodeRef } from '../types.js';
+import type { A11yNode, A11yTree, A11yQueryPattern, A11yQueryResult, ListedA11yTree, NodeRef } from '../types.js';
 /**
  * Builds accessibility tree from raw CDP nodes.
  *
@@ -14,6 +14,20 @@ import type { A11yNode, A11yTree, A11yQueryPattern, A11yQueryResult, NodeRef } f
  * @throws Error if no root node found
  */
 export declare function buildTreeFromRawNodes(rawNodes: Protocol.Accessibility.AXNode[]): A11yTree;
+/**
+ * The nodes `dom a11y tree` lists, depth-first from the root (then nodes not
+ * under it, such as frame content): the first `limit` (0 = all) no deeper
+ * than `maxDepth`. Noise ({@link isTreeNoise}) is counted as skipped and its
+ * children move up a level, so the budget goes to meaningful nodes; nodes cut
+ * by the limit or depth are counted as omitted. Every node of the tree is
+ * listed, omitted or skipped.
+ *
+ * @param tree - Accessibility tree
+ * @param limit - Nodes to list (0 = all listable ones)
+ * @param maxDepth - Deepest level to list (0 = root only; undefined = all)
+ * @returns Listed nodes with their depth, the tree size, and how many were cut or skipped
+ */
+export declare function listA11yTree(tree: A11yTree, limit: number, maxDepth?: number): ListedA11yTree;
 /**
  * Collects the full accessibility tree from the page via IPC.
  *

package/dist/telemetry/a11y.js

@@ -47,6 +47,89 @@ export function buildTreeFromRawNodes(rawNodes) {
     const root = nodes.get(rootRaw.nodeId);
     return { root, nodes, count: nodes.size };
 }
+/** Roles that only lay out their children and say nothing themselves */
+const LAYOUT_ROLES = new Set([
+    'generic',
+    'none',
+    'presentation',
+    'LayoutTable',
+    'LayoutTableRow',
+    'LayoutTableCell',
+]);
+/**
+ * Whether a node is left out of `dom a11y tree`: text boxes, blank text,
+ * text that repeats its parent's name, and nameless layout wrappers.
+ *
+ * @param node - Accessibility node
+ * @param parentName - Name of the nearest named ancestor
+ * @returns True when the node says nothing of its own
+ */
+function isTreeNoise(node, parentName) {
+    return (node.role === 'InlineTextBox' ||
+        (node.role === 'StaticText' && (node.name === parentName || !node.name?.trim())) ||
+        (LAYOUT_ROLES.has(node.role) && !node.name));
+}
+/**
+ * The nodes `dom a11y tree` lists, depth-first from the root (then nodes not
+ * under it, such as frame content): the first `limit` (0 = all) no deeper
+ * than `maxDepth`. Noise ({@link isTreeNoise}) is counted as skipped and its
+ * children move up a level, so the budget goes to meaningful nodes; nodes cut
+ * by the limit or depth are counted as omitted. Every node of the tree is
+ * listed, omitted or skipped.
+ *
+ * @param tree - Accessibility tree
+ * @param limit - Nodes to list (0 = all listable ones)
+ * @param maxDepth - Deepest level to list (0 = root only; undefined = all)
+ * @returns Listed nodes with their depth, the tree size, and how many were cut or skipped
+ */
+export function listA11yTree(tree, limit, maxDepth) {
+    const nodes = [];
+    const visited = new Set();
+    let omitted = 0;
+    let skipped = 0;
+    const visit = (node, depth, parentName) => {
+        if (visited.has(node.nodeId))
+            return;
+        visited.add(node.nodeId);
+        const listable = !isTreeNoise(node, parentName);
+        if (listable) {
+            const fits = (limit === 0 || nodes.length < limit) && (maxDepth ?? depth) >= depth;
+            if (fits)
+                nodes.push(listedNode(node, depth));
+            else
+                omitted++;
+        }
+        else {
+            skipped++;
+        }
+        for (const childId of node.childIds ?? []) {
+            const child = tree.nodes.get(childId);
+            if (child)
+                visit(child, listable ? depth + 1 : depth, node.name ?? parentName);
+        }
+    };
+    visit(tree.root, 0, undefined);
+    for (const node of tree.nodes.values())
+        visit(node, 0, undefined);
+    return {
+        nodes,
+        count: tree.count,
+        ...(omitted > 0 && { omitted }),
+        ...(skipped > 0 && { skipped }),
+    };
+}
+/**
+ * A node as the tree lists it: its depth instead of child ids (its children
+ * follow it, one level deeper).
+ *
+ * @param node - Accessibility node
+ * @param depth - Its level in the listing
+ * @returns Listed node
+ */
+function listedNode(node, depth) {
+    const { childIds: _childIds, ...rest } = node;
+    return { ...rest, depth };
+}
 /**
  * Ids of a node's children as shown: ignored children are replaced by their
  * own non-ignored descendants; ids missing from the tree are dropped.

package/dist/telemetry/har/builder.d.ts

@@ -18,11 +18,22 @@ export interface HARMetadata {
     /** Target title (optional) */
     targetTitle?: string;
 }
+/**
+ * Options for HAR generation.
+ */
+export interface HAROptions {
+    /** Keep credentials as captured instead of redacting them (see sanitize.ts) */
+    includeSensitive?: boolean;
+}
 /**
  * Build HAR 1.2 format from network telemetry data.
  *
+ * Credentials are redacted (`log.comment` says so) unless
+ * `options.includeSensitive` is set.
+ *
  * @param requests - Array of network requests collected during session
  * @param metadata - Metadata for HAR creator/browser info
+ * @param options - Whether to keep credentials
  * @returns Complete HAR object
  *
  * @remarks
@@ -39,5 +50,5 @@ export interface HARMetadata {
  * fs.writeFileSync('capture.har', JSON.stringify(har, null, 2));
  * ```
  */
-export declare function buildHAR(requests: NetworkRequest[], metadata: HARMetadata): HAR;
+export declare function buildHAR(requests: NetworkRequest[], metadata: HARMetadata, options?: HAROptions): HAR;
 //# sourceMappingURL=builder.d.ts.map

package/dist/telemetry/har/builder.js

@@ -2,7 +2,9 @@
  * HAR (HTTP Archive) builder for transforming network telemetry to HAR 1.2 format.
  */
 import { createRequire } from 'node:module';
-import { skippedBodyReason } from '../network.js';
+import { sanitizeEntry } from './sanitize.js';
+import { skippedBodyReason } from '../networkRetention.js';
+import { harSanitizedComment } from '../../ui/messages/networkMessages.js';
 /**
  * Loads Node builtins on first use: importing `node:http` in an ES module
  * reads all its exports, which loads undici and zlib (about 8 ms of every CLI
@@ -14,8 +16,12 @@ const DEFAULT_HTTP_VERSION = 'HTTP/1.1';
 /**
  * Build HAR 1.2 format from network telemetry data.
  *
+ * Credentials are redacted (`log.comment` says so) unless
+ * `options.includeSensitive` is set.
+ *
  * @param requests - Array of network requests collected during session
  * @param metadata - Metadata for HAR creator/browser info
+ * @param options - Whether to keep credentials
  * @returns Complete HAR object
  *
  * @remarks
@@ -32,8 +38,9 @@ const DEFAULT_HTTP_VERSION = 'HTTP/1.1';
  * fs.writeFileSync('capture.har', JSON.stringify(har, null, 2));
  * ```
  */
-export function buildHAR(requests, metadata) {
-    const entries = [...requests].sort((a, b) => a.timestamp - b.timestamp).map(buildEntry);
+export function buildHAR(requests, metadata, options = {}) {
+    const built = [...requests].sort((a, b) => a.timestamp - b.timestamp).map(buildEntry);
+    const entries = options.includeSensitive ? built : built.map(sanitizeEntry);
     const log = {
         version: '1.2',
         creator: {
@@ -42,6 +49,7 @@ export function buildHAR(requests, metadata) {
             comment: 'Browser Debugger CLI - https://github.com/szymdzum/browser-debugger-cli',
         },
         entries,
+        ...(!options.includeSensitive && { comment: harSanitizedComment() }),
     };
     if (metadata.chromeVersion) {
         log.browser = {

package/dist/telemetry/har/sanitize.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Credential redaction for HAR exports.
+ *
+ * HAR files are made to be shared (bug reports, tickets), so `bdg network har`
+ * redacts credentials by default, as Chrome DevTools does since Chrome 130.
+ * Chrome's sanitized export drops the `Cookie`, `Set-Cookie` and
+ * `Authorization` headers and empties the `cookies` arrays; bdg instead keeps
+ * every header, cookie and parameter name (and cookie attributes such as
+ * `httpOnly`) with the value `[redacted]`, so the export still shows that a
+ * request was authenticated and which cookies were set. It also covers API
+ * key, token and session headers, credential query parameters in URLs
+ * (`?code=`, `?access_token=`) and credential fields of request bodies
+ * (sanitizeBody.ts). `headersSize` and `bodySize` stay those of the captured
+ * request. Response bodies and WebSocket messages are not redacted.
+ */
+import type { Entry } from './types.js';
+/**
+ * Redact the credentials of a HAR entry.
+ *
+ * @param entry - Entry built from the captured request
+ * @returns Copy of the entry with credential values replaced by {@link REDACTED}
+ */
+export declare function sanitizeEntry(entry: Entry): Entry;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/telemetry/har/sanitize.js

@@ -0,0 +1,138 @@
+/**
+ * Credential redaction for HAR exports.
+ *
+ * HAR files are made to be shared (bug reports, tickets), so `bdg network har`
+ * redacts credentials by default, as Chrome DevTools does since Chrome 130.
+ * Chrome's sanitized export drops the `Cookie`, `Set-Cookie` and
+ * `Authorization` headers and empties the `cookies` arrays; bdg instead keeps
+ * every header, cookie and parameter name (and cookie attributes such as
+ * `httpOnly`) with the value `[redacted]`, so the export still shows that a
+ * request was authenticated and which cookies were set. It also covers API
+ * key, token and session headers, credential query parameters in URLs
+ * (`?code=`, `?access_token=`) and credential fields of request bodies
+ * (sanitizeBody.ts). `headersSize` and `bodySize` stay those of the captured
+ * request. Response bodies and WebSocket messages are not redacted.
+ */
+import { REDACTED, isSensitiveField, redactPairs, redactRequestBody, } from './sanitizeBody.js';
+/** {@link REDACTED} as written in a URL */
+const URL_REDACTED = encodeURIComponent(REDACTED);
+/** Headers whose values are credentials, lowercased (others match by pattern) */
+const SENSITIVE_HEADERS = new Set([
+    'authorization',
+    'proxy-authorization',
+    'authentication',
+    'cookie',
+    'set-cookie',
+]);
+/** Custom headers carrying keys or tokens (`X-Api-Key`, `X-Auth-Token`, `X-CSRF-Token`) */
+const SENSITIVE_CUSTOM_HEADER = /^x-.*(key|token|secret|auth)/i;
+/**
+ * Headers with a credential segment between hyphens (`api-key`,
+ * `private-token`, `cf-access-jwt-assertion`, `ocp-apim-subscription-key`,
+ * `session-id`); `www-authenticate` and `proxy-authenticate` do not match
+ */
+const SENSITIVE_HEADER_SEGMENT = /(^|-)(api-?key|apikey|token|secret|jwt|subscription-key|session(-?id)?)(-|$)/i;
+/** Headers whose values are URLs that may carry credential parameters */
+const URL_HEADERS = new Set(['location', 'referer']);
+/** Query parameter names that hold credentials in URLs only (OAuth codes, signed URLs, API keys) */
+const SENSITIVE_URL_PARAM = /^(code|sig|key)$/i;
+/**
+ * Redact the credentials of a HAR entry.
+ *
+ * @param entry - Entry built from the captured request
+ * @returns Copy of the entry with credential values replaced by {@link REDACTED}
+ */
+export function sanitizeEntry(entry) {
+    const { request, response } = entry;
+    const postData = request.postData;
+    return {
+        ...entry,
+        request: {
+            ...request,
+            url: redactUrl(request.url),
+            cookies: request.cookies.map(redactCookie),
+            headers: request.headers.map(redactHeader),
+            queryString: request.queryString.map(redactQueryParam),
+            ...(postData?.text !== undefined && {
+                postData: { ...postData, text: redactRequestBody(postData.text, postData.mimeType) },
+            }),
+        },
+        response: {
+            ...response,
+            cookies: response.cookies.map(redactCookie),
+            headers: response.headers.map(redactHeader),
+            redirectURL: redactUrl(response.redirectURL),
+        },
+    };
+}
+/**
+ * Whether a header carries a credential.
+ *
+ * @param name - Header name (any case)
+ * @returns True for auth, cookie, API key, token, secret and session headers
+ */
+function isSensitiveHeader(name) {
+    return (SENSITIVE_HEADERS.has(name.toLowerCase()) ||
+        SENSITIVE_CUSTOM_HEADER.test(name) ||
+        SENSITIVE_HEADER_SEGMENT.test(name));
+}
+/**
+ * Redact a header's value if it carries a credential, or the credential
+ * parameters of a `Location` or `Referer` URL.
+ *
+ * @param header - HAR header
+ * @returns The header, or a copy with its value redacted
+ */
+function redactHeader(header) {
+    if (isSensitiveHeader(header.name))
+        return { ...header, value: REDACTED };
+    if (!URL_HEADERS.has(header.name.toLowerCase()))
+        return header;
+    const value = redactUrl(header.value);
+    return value === header.value ? header : { ...header, value };
+}
+/**
+ * Redact a cookie's value, keeping its name and attributes.
+ *
+ * @param cookie - HAR cookie
+ * @returns Copy with the value redacted
+ */
+function redactCookie(cookie) {
+    return { ...cookie, value: REDACTED };
+}
+/**
+ * Whether a URL query or fragment parameter holds a credential.
+ *
+ * @param name - Decoded parameter name
+ * @returns True for credential field names, `code`, `sig` and `key`
+ */
+function isSensitiveParam(name) {
+    return isSensitiveField(name) || SENSITIVE_URL_PARAM.test(name);
+}
+/**
+ * Redact a parsed query parameter if it holds a credential.
+ *
+ * @param param - HAR query parameter
+ * @returns The parameter, or a copy with its value redacted
+ */
+function redactQueryParam(param) {
+    return isSensitiveParam(param.name) ? { ...param, value: REDACTED } : param;
+}
+/**
+ * Redact credential parameter values in a URL's query and fragment
+ * (`#access_token=` of the OAuth implicit flow), leaving the rest byte for byte.
+ *
+ * @param url - URL (empty for none)
+ * @returns URL with credential values replaced by the URL-encoded {@link REDACTED}
+ */
+function redactUrl(url) {
+    const hash = url.indexOf('#');
+    const beforeHash = hash === -1 ? url : url.slice(0, hash);
+    const fragment = hash === -1 ? '' : `#${redactPairs(url.slice(hash + 1), isSensitiveParam, URL_REDACTED)}`;
+    const question = beforeHash.indexOf('?');
+    if (question === -1)
+        return beforeHash + fragment;
+    const query = redactPairs(beforeHash.slice(question + 1), isSensitiveParam, URL_REDACTED);
+    return `${beforeHash.slice(0, question)}?${query}${fragment}`;
+}
+//# sourceMappingURL=sanitize.js.map