crypto-aio 0.0.2 → 0.1.0

package/dist/core/registry/plugin.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCatalogs = createCatalogs;
+exports.cloneCatalogs = cloneCatalogs;
+exports.applyPlugin = applyPlugin;
+exports.samePlugin = samePlugin;
+const error_1 = require("../errors/error");
+const adapters_1 = require("./adapters");
+const assets_1 = require("./assets");
+const chains_1 = require("./chains");
+const providers_1 = require("./providers");
+const schemes_1 = require("./schemes");
+function createCatalogs() {
+    return {
+        chains: new chains_1.ChainCatalog(),
+        assets: new assets_1.AssetCatalog(),
+        adapters: new adapters_1.AdapterCatalog(),
+        presets: new providers_1.PresetCatalog(),
+        schemes: new schemes_1.SchemeCatalog(schemes_1.BUILTIN_SCHEMES),
+        plugins: new Map(),
+    };
+}
+function cloneCatalogs(catalogs) {
+    return {
+        chains: catalogs.chains.clone(),
+        assets: catalogs.assets.clone(),
+        adapters: catalogs.adapters.clone(),
+        presets: catalogs.presets.clone(),
+        schemes: catalogs.schemes.clone(),
+        plugins: new Map(catalogs.plugins),
+    };
+}
+/**
+ * Registers a plugin. Registering the same plugin again (`samePlugin`) is a no-op, so
+ * `use()` stays idempotent; a different plugin under a registered name is `CONFIG_INVALID`.
+ */
+function applyPlugin(catalogs, plugin) {
+    const registered = catalogs.plugins.get(plugin.name);
+    if (registered) {
+        if (samePlugin(registered, plugin))
+            return;
+        throw new error_1.ConfigError('CONFIG_INVALID', `plugin '${plugin.name}' is already registered with a different definition`);
+    }
+    for (const scheme of plugin.schemes ?? [])
+        catalogs.schemes.register(scheme);
+    for (const chain of plugin.chains ?? []) {
+        for (const scheme of chain.schemes)
+            catalogs.schemes.get(scheme);
+        catalogs.chains.register(chain);
+        catalogs.assets.registerNative(chain);
+    }
+    for (const manifest of plugin.adapters ?? []) {
+        for (const chainId of manifest.chains)
+            catalogs.chains.get(chainId);
+        catalogs.adapters.register(manifest);
+    }
+    for (const preset of plugin.presets ?? [])
+        catalogs.presets.register(preset);
+    for (const asset of plugin.assets ?? []) {
+        catalogs.chains.network(asset.chain, asset.network);
+        catalogs.assets.register(asset);
+    }
+    catalogs.plugins.set(plugin.name, plugin);
+}
+/**
+ * Whether two plugins are the same: the same object, or structurally equal
+ * data around the same functions. Functions and class instances match only themselves (a
+ * closure over other values, or a bound function, is another function), so a factory
+ * such as `evmPlugin()` keeps its functions at module level to stay idempotent. Data is
+ * every own enumerable key, symbols included, and every array index: a hole matches only
+ * a hole.
+ */
+function samePlugin(a, b) {
+    return sameShape(a, b, 0);
+}
+function sameShape(a, b, depth) {
+    if (Object.is(a, b))
+        return true;
+    if (depth > 64)
+        return false;
+    if (typeof a === 'function' || typeof b === 'function')
+        return false;
+    if (typeof a !== 'object' || typeof b !== 'object' || a === null || b === null) {
+        return false;
+    }
+    if (Array.isArray(a) || Array.isArray(b)) {
+        return (Array.isArray(a) &&
+            Array.isArray(b) &&
+            a.length === b.length &&
+            // Every index: `every` would skip a's holes.
+            [...a.keys()].every((i) => i in a === i in b && sameShape(a[i], b[i], depth + 1)));
+    }
+    const proto = Object.getPrototypeOf(a);
+    if ((proto !== Object.prototype && proto !== null) ||
+        Object.getPrototypeOf(b) !== proto) {
+        return false;
+    }
+    const left = a;
+    const right = b;
+    const keys = dataKeys(left);
+    return (keys.length === dataKeys(right).length &&
+        keys.every((key) => Object.prototype.propertyIsEnumerable.call(right, key) &&
+            sameShape(left[key], right[key], depth + 1)));
+}
+/** An object's own enumerable keys, symbols included. */
+function dataKeys(value) {
+    return Reflect.ownKeys(value).filter((key) => Object.prototype.propertyIsEnumerable.call(value, key));
+}
+//# sourceMappingURL=plugin.js.map

package/dist/core/registry/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/core/registry/plugin.ts"],"names":[],"mappings":";;AA6BA,wCASC;AAED,sCASC;AAMD,kCAyBC;AAUD,gCAEC;AA3FD,2CAA8C;AAE9C,yCAA4C;AAC5C,qCAAgE;AAChE,qCAAwC;AACxC,2CAAiE;AACjE,uCAAiF;AAsBjF,SAAgB,cAAc;IAC5B,OAAO;QACL,MAAM,EAAE,IAAI,qBAAY,EAAE;QAC1B,MAAM,EAAE,IAAI,qBAAY,EAAE;QAC1B,QAAQ,EAAE,IAAI,yBAAc,EAAE;QAC9B,OAAO,EAAE,IAAI,yBAAa,EAAE;QAC5B,OAAO,EAAE,IAAI,uBAAa,CAAC,yBAAe,CAAC;QAC3C,OAAO,EAAE,IAAI,GAAG,EAAE;KACnB,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAAC,QAAkB;IAC9C,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE;QAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE;QACnC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE;QACjC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE;QACjC,OAAO,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,QAAkB,EAAE,MAAc;IAC5D,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC;YAAE,OAAO;QAC3C,MAAM,IAAI,mBAAW,CACnB,gBAAgB,EAChB,WAAW,MAAM,CAAC,IAAI,qDAAqD,CAC5E,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7E,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACxC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO;YAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC7C,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM;YAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7E,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACxC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,UAAU,CAAC,CAAS,EAAE,CAAS;IAC7C,OAAO,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU,EAAE,KAAa;IACtD,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,OAAO,CAAC,KAAK,UAAU,IAAI,OAAO,CAAC,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAChB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAChB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YACrB,6CAA6C;YAC7C,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAY,CAAC;IAClD,IACE,CAAC,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;QAC9C,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,KAAK,EAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,CAAiC,CAAC;IAC/C,MAAM,KAAK,GAAG,CAAiC,CAAC;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM;QACtC,IAAI,CAAC,KAAK,CACR,CAAC,GAAG,EAAE,EAAE,CACN,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;YACtD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAC9C,CACF,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAC3C,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CACvD,CAAC;AACJ,CAAC","sourcesContent":["import type { AdapterManifest } from '../driver/types';\nimport { ConfigError } from '../errors/error';\nimport type { ChainInfo } from '../model/chain';\nimport { AdapterCatalog } from './adapters';\nimport { AssetCatalog, type AssetRegistration } from './assets';\nimport { ChainCatalog } from './chains';\nimport { PresetCatalog, type ProviderPreset } from './providers';\nimport { BUILTIN_SCHEMES, SchemeCatalog, type SignatureScheme } from './schemes';\n\n/** Everything a chain family contributes. Plugin modules must not import SDKs. */\nexport interface Plugin {\n  readonly name: string;\n  readonly chains?: readonly ChainInfo[];\n  readonly adapters?: readonly AdapterManifest[];\n  readonly presets?: readonly ProviderPreset[];\n  readonly assets?: readonly AssetRegistration[];\n  readonly schemes?: readonly SignatureScheme[];\n}\n\nexport interface Catalogs {\n  readonly chains: ChainCatalog;\n  readonly assets: AssetCatalog;\n  readonly adapters: AdapterCatalog;\n  readonly presets: PresetCatalog;\n  readonly schemes: SchemeCatalog;\n  /** Every registered plugin by name, to tell a repeat from a different plugin. */\n  readonly plugins: Map<string, Plugin>;\n}\n\nexport function createCatalogs(): Catalogs {\n  return {\n    chains: new ChainCatalog(),\n    assets: new AssetCatalog(),\n    adapters: new AdapterCatalog(),\n    presets: new PresetCatalog(),\n    schemes: new SchemeCatalog(BUILTIN_SCHEMES),\n    plugins: new Map(),\n  };\n}\n\nexport function cloneCatalogs(catalogs: Catalogs): Catalogs {\n  return {\n    chains: catalogs.chains.clone(),\n    assets: catalogs.assets.clone(),\n    adapters: catalogs.adapters.clone(),\n    presets: catalogs.presets.clone(),\n    schemes: catalogs.schemes.clone(),\n    plugins: new Map(catalogs.plugins),\n  };\n}\n\n/**\n * Registers a plugin. Registering the same plugin again (`samePlugin`) is a no-op, so\n * `use()` stays idempotent; a different plugin under a registered name is `CONFIG_INVALID`.\n */\nexport function applyPlugin(catalogs: Catalogs, plugin: Plugin): void {\n  const registered = catalogs.plugins.get(plugin.name);\n  if (registered) {\n    if (samePlugin(registered, plugin)) return;\n    throw new ConfigError(\n      'CONFIG_INVALID',\n      `plugin '${plugin.name}' is already registered with a different definition`,\n    );\n  }\n  for (const scheme of plugin.schemes ?? []) catalogs.schemes.register(scheme);\n  for (const chain of plugin.chains ?? []) {\n    for (const scheme of chain.schemes) catalogs.schemes.get(scheme);\n    catalogs.chains.register(chain);\n    catalogs.assets.registerNative(chain);\n  }\n  for (const manifest of plugin.adapters ?? []) {\n    for (const chainId of manifest.chains) catalogs.chains.get(chainId);\n    catalogs.adapters.register(manifest);\n  }\n  for (const preset of plugin.presets ?? []) catalogs.presets.register(preset);\n  for (const asset of plugin.assets ?? []) {\n    catalogs.chains.network(asset.chain, asset.network);\n    catalogs.assets.register(asset);\n  }\n  catalogs.plugins.set(plugin.name, plugin);\n}\n\n/**\n * Whether two plugins are the same: the same object, or structurally equal\n * data around the same functions. Functions and class instances match only themselves (a\n * closure over other values, or a bound function, is another function), so a factory\n * such as `evmPlugin()` keeps its functions at module level to stay idempotent. Data is\n * every own enumerable key, symbols included, and every array index: a hole matches only\n * a hole.\n */\nexport function samePlugin(a: Plugin, b: Plugin): boolean {\n  return sameShape(a, b, 0);\n}\n\nfunction sameShape(a: unknown, b: unknown, depth: number): boolean {\n  if (Object.is(a, b)) return true;\n  if (depth > 64) return false;\n  if (typeof a === 'function' || typeof b === 'function') return false;\n  if (typeof a !== 'object' || typeof b !== 'object' || a === null || b === null) {\n    return false;\n  }\n  if (Array.isArray(a) || Array.isArray(b)) {\n    return (\n      Array.isArray(a) &&\n      Array.isArray(b) &&\n      a.length === b.length &&\n      // Every index: `every` would skip a's holes.\n      [...a.keys()].every((i) => i in a === i in b && sameShape(a[i], b[i], depth + 1))\n    );\n  }\n  const proto = Object.getPrototypeOf(a) as unknown;\n  if (\n    (proto !== Object.prototype && proto !== null) ||\n    Object.getPrototypeOf(b) !== proto\n  ) {\n    return false;\n  }\n  const left = a as Record<PropertyKey, unknown>;\n  const right = b as Record<PropertyKey, unknown>;\n  const keys = dataKeys(left);\n  return (\n    keys.length === dataKeys(right).length &&\n    keys.every(\n      (key) =>\n        Object.prototype.propertyIsEnumerable.call(right, key) &&\n        sameShape(left[key], right[key], depth + 1),\n    )\n  );\n}\n\n/** An object's own enumerable keys, symbols included. */\nfunction dataKeys(value: object): (string | symbol)[] {\n  return Reflect.ownKeys(value).filter((key) =>\n    Object.prototype.propertyIsEnumerable.call(value, key),\n  );\n}\n"]}

package/dist/core/registry/providers.d.ts

@@ -0,0 +1,31 @@
+import type { Secret } from '../secret/secret';
+import type { EndpointConfig } from '../transport/types';
+export interface PresetInput {
+    readonly chain: string;
+    readonly network: string;
+    readonly apiKey?: string | Secret<string>;
+    readonly options?: Readonly<Record<string, unknown>>;
+}
+/** Provider preset contributed by a family plugin. Endpoint URLs holding keys must be `Secret`s. */
+export interface ProviderPreset {
+    readonly name: string;
+    readonly kind: 'rpc' | 'indexer';
+    readonly requiresApiKey?: boolean;
+    /** `false` for free public endpoints (logged as not for production). */
+    readonly production?: boolean;
+    supports(chain: string, network: string): boolean;
+    endpoints(input: PresetInput): readonly EndpointConfig[];
+}
+export declare class PresetCatalog {
+    #private;
+    /** Several families may contribute presets with the same name (e.g. one per chain family). */
+    register(preset: ProviderPreset): void;
+    has(name: string, kind?: 'rpc' | 'indexer'): boolean;
+    /** The registered preset names, of one kind or of both. */
+    names(kind?: 'rpc' | 'indexer'): string[];
+    resolve(name: string, input: PresetInput, kind: 'rpc' | 'indexer'): {
+        readonly endpoints: readonly EndpointConfig[];
+        readonly preset: ProviderPreset;
+    };
+    clone(): PresetCatalog;
+}

package/dist/core/registry/providers.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PresetCatalog = void 0;
+const error_1 = require("../errors/error");
+const names_1 = require("../util/names");
+class PresetCatalog {
+    #presets = new Map();
+    /** Several families may contribute presets with the same name (e.g. one per chain family). */
+    register(preset) {
+        const list = this.#presets.get(preset.name) ?? [];
+        list.push(preset);
+        this.#presets.set(preset.name, list);
+    }
+    has(name, kind) {
+        return (this.#presets.get(name) ?? []).some((p) => kind === undefined || p.kind === kind);
+    }
+    /** The registered preset names, of one kind or of both. */
+    names(kind) {
+        return [...this.#presets.keys()].filter((name) => this.has(name, kind));
+    }
+    resolve(name, input, kind) {
+        const candidates = (this.#presets.get(name) ?? []).filter((p) => p.kind === kind);
+        if (candidates.length === 0) {
+            throw new error_1.ConfigError('CONFIG_INVALID', (0, names_1.unknownName)(`${kind} provider preset`, this.names(kind)));
+        }
+        const preset = candidates.find((p) => p.supports(input.chain, input.network));
+        if (!preset) {
+            throw new error_1.ConfigError('CONFIG_INVALID', `provider preset '${name}' does not support ${input.chain}:${input.network}`);
+        }
+        if (preset.requiresApiKey && input.apiKey === undefined) {
+            throw new error_1.ConfigError('CONFIG_INVALID', `provider preset '${name}' requires an apiKey`);
+        }
+        return { endpoints: preset.endpoints(input), preset };
+    }
+    clone() {
+        const copy = new PresetCatalog();
+        for (const [name, list] of this.#presets)
+            copy.#presets.set(name, [...list]);
+        return copy;
+    }
+}
+exports.PresetCatalog = PresetCatalog;
+//# sourceMappingURL=providers.js.map

package/dist/core/registry/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../../src/core/registry/providers.ts"],"names":[],"mappings":";;;AAAA,2CAA8C;AAG9C,yCAA4C;AAoB5C,MAAa,aAAa;IACf,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;IAExD,8FAA8F;IAC9F,QAAQ,CAAC,MAAsB;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,GAAG,CAAC,IAAY,EAAE,IAAwB;QACxC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAC7C,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,IAAwB;QAC5B,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,CACL,IAAY,EACZ,KAAkB,EAClB,IAAuB;QAEvB,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAW,CACnB,gBAAgB,EAChB,IAAA,mBAAW,EAAC,GAAG,IAAI,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CACzD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,mBAAW,CACnB,gBAAgB,EAChB,oBAAoB,IAAI,sBAAsB,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAC7E,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACxD,MAAM,IAAI,mBAAW,CACnB,gBAAgB,EAChB,oBAAoB,IAAI,sBAAsB,CAC/C,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACxD,CAAC;IAED,KAAK;QACH,MAAM,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAtDD,sCAsDC","sourcesContent":["import { ConfigError } from '../errors/error';\nimport type { Secret } from '../secret/secret';\nimport type { EndpointConfig } from '../transport/types';\nimport { unknownName } from '../util/names';\n\nexport interface PresetInput {\n  readonly chain: string;\n  readonly network: string;\n  readonly apiKey?: string | Secret<string>;\n  readonly options?: Readonly<Record<string, unknown>>;\n}\n\n/** Provider preset contributed by a family plugin. Endpoint URLs holding keys must be `Secret`s. */\nexport interface ProviderPreset {\n  readonly name: string;\n  readonly kind: 'rpc' | 'indexer';\n  readonly requiresApiKey?: boolean;\n  /** `false` for free public endpoints (logged as not for production). */\n  readonly production?: boolean;\n  supports(chain: string, network: string): boolean;\n  endpoints(input: PresetInput): readonly EndpointConfig[];\n}\n\nexport class PresetCatalog {\n  readonly #presets = new Map<string, ProviderPreset[]>();\n\n  /** Several families may contribute presets with the same name (e.g. one per chain family). */\n  register(preset: ProviderPreset): void {\n    const list = this.#presets.get(preset.name) ?? [];\n    list.push(preset);\n    this.#presets.set(preset.name, list);\n  }\n\n  has(name: string, kind?: 'rpc' | 'indexer'): boolean {\n    return (this.#presets.get(name) ?? []).some(\n      (p) => kind === undefined || p.kind === kind,\n    );\n  }\n\n  /** The registered preset names, of one kind or of both. */\n  names(kind?: 'rpc' | 'indexer'): string[] {\n    return [...this.#presets.keys()].filter((name) => this.has(name, kind));\n  }\n\n  resolve(\n    name: string,\n    input: PresetInput,\n    kind: 'rpc' | 'indexer',\n  ): { readonly endpoints: readonly EndpointConfig[]; readonly preset: ProviderPreset } {\n    const candidates = (this.#presets.get(name) ?? []).filter((p) => p.kind === kind);\n    if (candidates.length === 0) {\n      throw new ConfigError(\n        'CONFIG_INVALID',\n        unknownName(`${kind} provider preset`, this.names(kind)),\n      );\n    }\n    const preset = candidates.find((p) => p.supports(input.chain, input.network));\n    if (!preset) {\n      throw new ConfigError(\n        'CONFIG_INVALID',\n        `provider preset '${name}' does not support ${input.chain}:${input.network}`,\n      );\n    }\n    if (preset.requiresApiKey && input.apiKey === undefined) {\n      throw new ConfigError(\n        'CONFIG_INVALID',\n        `provider preset '${name}' requires an apiKey`,\n      );\n    }\n    return { endpoints: preset.endpoints(input), preset };\n  }\n\n  clone(): PresetCatalog {\n    const copy = new PresetCatalog();\n    for (const [name, list] of this.#presets) copy.#presets.set(name, [...list]);\n    return copy;\n  }\n}\n"]}

package/dist/core/registry/schemes.d.ts

@@ -0,0 +1,30 @@
+import type { SigningParams } from '../signing/types';
+export interface VerifyInput {
+    readonly publicKey: Uint8Array;
+    readonly payload: Uint8Array;
+    readonly signature: Uint8Array;
+    readonly recovery?: number;
+    readonly params?: SigningParams;
+}
+export interface SignatureScheme {
+    readonly id: string;
+    readonly publicKeyLength: number;
+    verify(input: VerifyInput): boolean;
+}
+/** 32-byte digest, 64-byte compact low-s signature, recovery bit required and checked. */
+export declare const secp256k1Ecdsa: Readonly<SignatureScheme>;
+/** BIP340 over a 32-byte message; the request's public key is the (possibly tweaked) x-only key. */
+export declare const secp256k1Schnorr: Readonly<SignatureScheme>;
+/** RFC 8032 strict verification (zip215 disabled). */
+export declare const ed25519Scheme: Readonly<SignatureScheme>;
+/** Frozen, like each scheme in it. */
+export declare const BUILTIN_SCHEMES: readonly SignatureScheme[];
+export declare class SchemeCatalog {
+    #private;
+    constructor(initial?: readonly SignatureScheme[]);
+    register(scheme: SignatureScheme): void;
+    has(id: string): boolean;
+    get(id: string): SignatureScheme;
+    list(): SignatureScheme[];
+    clone(): SchemeCatalog;
+}

package/dist/core/registry/schemes.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SchemeCatalog = exports.BUILTIN_SCHEMES = exports.ed25519Scheme = exports.secp256k1Schnorr = exports.secp256k1Ecdsa = void 0;
+const ed25519_1 = require("@noble/curves/ed25519");
+const secp256k1_1 = require("@noble/curves/secp256k1");
+const error_1 = require("../errors/error");
+const bytes_1 = require("../util/bytes");
+const names_1 = require("../util/names");
+function safely(check) {
+    try {
+        return check();
+    }
+    catch {
+        return false;
+    }
+}
+/** 32-byte digest, 64-byte compact low-s signature, recovery bit required and checked. */
+exports.secp256k1Ecdsa = Object.freeze({
+    id: 'secp256k1-ecdsa',
+    publicKeyLength: 33,
+    verify: ({ publicKey, payload, signature, recovery }) => safely(() => {
+        if (payload.length !== 32 || signature.length !== 64)
+            return false;
+        if (recovery !== 0 && recovery !== 1)
+            return false;
+        const sig = secp256k1_1.secp256k1.Signature.fromCompact(signature);
+        if (!secp256k1_1.secp256k1.verify(signature, payload, publicKey, { lowS: true }))
+            return false;
+        const recovered = sig
+            .addRecoveryBit(recovery)
+            .recoverPublicKey(payload)
+            .toRawBytes(true);
+        return (0, bytes_1.equalBytes)(recovered, publicKey);
+    }),
+});
+/** BIP340 over a 32-byte message; the request's public key is the (possibly tweaked) x-only key. */
+exports.secp256k1Schnorr = Object.freeze({
+    id: 'secp256k1-schnorr',
+    publicKeyLength: 32,
+    verify: ({ publicKey, payload, signature }) => safely(() => payload.length === 32 && secp256k1_1.schnorr.verify(signature, payload, publicKey)),
+});
+/** RFC 8032 strict verification (zip215 disabled). */
+exports.ed25519Scheme = Object.freeze({
+    id: 'ed25519',
+    publicKeyLength: 32,
+    verify: ({ publicKey, payload, signature }) => safely(() => ed25519_1.ed25519.verify(signature, payload, publicKey, { zip215: false })),
+});
+/** Frozen, like each scheme in it. */
+exports.BUILTIN_SCHEMES = Object.freeze([
+    exports.secp256k1Ecdsa,
+    exports.secp256k1Schnorr,
+    exports.ed25519Scheme,
+]);
+class SchemeCatalog {
+    #schemes = new Map();
+    constructor(initial = []) {
+        for (const scheme of initial)
+            this.register(scheme);
+    }
+    register(scheme) {
+        if (this.#schemes.has(scheme.id)) {
+            throw new error_1.ConfigError('CONFIG_INVALID', `signature scheme '${scheme.id}' is already registered`);
+        }
+        this.#schemes.set(scheme.id, scheme);
+    }
+    has(id) {
+        return this.#schemes.has(id);
+    }
+    get(id) {
+        const scheme = this.#schemes.get(id);
+        if (!scheme) {
+            throw new error_1.ConfigError('CONFIG_INVALID', (0, names_1.unknownName)('signature scheme', this.#schemes.keys()));
+        }
+        return scheme;
+    }
+    list() {
+        return [...this.#schemes.values()];
+    }
+    clone() {
+        return new SchemeCatalog(this.list());
+    }
+}
+exports.SchemeCatalog = SchemeCatalog;
+//# sourceMappingURL=schemes.js.map

package/dist/core/registry/schemes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemes.js","sourceRoot":"","sources":["../../../src/core/registry/schemes.ts"],"names":[],"mappings":";;;AAAA,mDAAgD;AAChD,uDAA6D;AAC7D,2CAA8C;AAE9C,yCAA2C;AAC3C,yCAA4C;AAgB5C,SAAS,MAAM,CAAC,KAAoB;IAClC,IAAI,CAAC;QACH,OAAO,KAAK,EAAE,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,0FAA0F;AAC7E,QAAA,cAAc,GAAG,MAAM,CAAC,MAAM,CAAkB;IAC3D,EAAE,EAAE,iBAAiB;IACrB,eAAe,EAAE,EAAE;IACnB,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CACtD,MAAM,CAAC,GAAG,EAAE;QACV,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QACnE,IAAI,QAAQ,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,MAAM,GAAG,GAAG,qBAAS,CAAC,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,qBAAS,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACnF,MAAM,SAAS,GAAG,GAAG;aAClB,cAAc,CAAC,QAAQ,CAAC;aACxB,gBAAgB,CAAC,OAAO,CAAC;aACzB,UAAU,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,IAAA,kBAAU,EAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC,CAAC;CACL,CAAC,CAAC;AAEH,oGAAoG;AACvF,QAAA,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAkB;IAC7D,EAAE,EAAE,mBAAmB;IACvB,eAAe,EAAE,EAAE;IACnB,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAC5C,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,EAAE,IAAI,mBAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;CACvF,CAAC,CAAC;AAEH,sDAAsD;AACzC,QAAA,aAAa,GAAG,MAAM,CAAC,MAAM,CAAkB;IAC1D,EAAE,EAAE,SAAS;IACb,eAAe,EAAE,EAAE;IACnB,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAC5C,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;CACjF,CAAC,CAAC;AAEH,sCAAsC;AACzB,QAAA,eAAe,GAA+B,MAAM,CAAC,MAAM,CAAC;IACvE,sBAAc;IACd,wBAAgB;IAChB,qBAAa;CACd,CAAC,CAAC;AAEH,MAAa,aAAa;IACf,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEvD,YAAY,UAAsC,EAAE;QAClD,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IAED,QAAQ,CAAC,MAAuB;QAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,mBAAW,CACnB,gBAAgB,EAChB,qBAAqB,MAAM,CAAC,EAAE,yBAAyB,CACxD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,mBAAW,CACnB,gBAAgB,EAChB,IAAA,mBAAW,EAAC,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,KAAK;QACH,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;CACF;AAvCD,sCAuCC","sourcesContent":["import { ed25519 } from '@noble/curves/ed25519';\nimport { schnorr, secp256k1 } from '@noble/curves/secp256k1';\nimport { ConfigError } from '../errors/error';\nimport type { SigningParams } from '../signing/types';\nimport { equalBytes } from '../util/bytes';\nimport { unknownName } from '../util/names';\n\nexport interface VerifyInput {\n  readonly publicKey: Uint8Array;\n  readonly payload: Uint8Array;\n  readonly signature: Uint8Array;\n  readonly recovery?: number;\n  readonly params?: SigningParams;\n}\n\nexport interface SignatureScheme {\n  readonly id: string;\n  readonly publicKeyLength: number;\n  verify(input: VerifyInput): boolean;\n}\n\nfunction safely(check: () => boolean): boolean {\n  try {\n    return check();\n  } catch {\n    return false;\n  }\n}\n\n/** 32-byte digest, 64-byte compact low-s signature, recovery bit required and checked. */\nexport const secp256k1Ecdsa = Object.freeze<SignatureScheme>({\n  id: 'secp256k1-ecdsa',\n  publicKeyLength: 33,\n  verify: ({ publicKey, payload, signature, recovery }) =>\n    safely(() => {\n      if (payload.length !== 32 || signature.length !== 64) return false;\n      if (recovery !== 0 && recovery !== 1) return false;\n      const sig = secp256k1.Signature.fromCompact(signature);\n      if (!secp256k1.verify(signature, payload, publicKey, { lowS: true })) return false;\n      const recovered = sig\n        .addRecoveryBit(recovery)\n        .recoverPublicKey(payload)\n        .toRawBytes(true);\n      return equalBytes(recovered, publicKey);\n    }),\n});\n\n/** BIP340 over a 32-byte message; the request's public key is the (possibly tweaked) x-only key. */\nexport const secp256k1Schnorr = Object.freeze<SignatureScheme>({\n  id: 'secp256k1-schnorr',\n  publicKeyLength: 32,\n  verify: ({ publicKey, payload, signature }) =>\n    safely(() => payload.length === 32 && schnorr.verify(signature, payload, publicKey)),\n});\n\n/** RFC 8032 strict verification (zip215 disabled). */\nexport const ed25519Scheme = Object.freeze<SignatureScheme>({\n  id: 'ed25519',\n  publicKeyLength: 32,\n  verify: ({ publicKey, payload, signature }) =>\n    safely(() => ed25519.verify(signature, payload, publicKey, { zip215: false })),\n});\n\n/** Frozen, like each scheme in it. */\nexport const BUILTIN_SCHEMES: readonly SignatureScheme[] = Object.freeze([\n  secp256k1Ecdsa,\n  secp256k1Schnorr,\n  ed25519Scheme,\n]);\n\nexport class SchemeCatalog {\n  readonly #schemes = new Map<string, SignatureScheme>();\n\n  constructor(initial: readonly SignatureScheme[] = []) {\n    for (const scheme of initial) this.register(scheme);\n  }\n\n  register(scheme: SignatureScheme): void {\n    if (this.#schemes.has(scheme.id)) {\n      throw new ConfigError(\n        'CONFIG_INVALID',\n        `signature scheme '${scheme.id}' is already registered`,\n      );\n    }\n    this.#schemes.set(scheme.id, scheme);\n  }\n\n  has(id: string): boolean {\n    return this.#schemes.has(id);\n  }\n\n  get(id: string): SignatureScheme {\n    const scheme = this.#schemes.get(id);\n    if (!scheme) {\n      throw new ConfigError(\n        'CONFIG_INVALID',\n        unknownName('signature scheme', this.#schemes.keys()),\n      );\n    }\n    return scheme;\n  }\n\n  list(): SignatureScheme[] {\n    return [...this.#schemes.values()];\n  }\n\n  clone(): SchemeCatalog {\n    return new SchemeCatalog(this.list());\n  }\n}\n"]}

package/dist/core/secret/fragments.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The shortest fragment scrubbed on its own. Every built-in keyed preset's key is at least
+ * 32 characters (Alchemy, Infura, Ankr, TronGrid, toncenter), while the ordinary words of an
+ * endpoint URL are shorter than 8 (`v2`, `v3`, `api`, `rpc`, `eth`, `bsc`, `solana`,
+ * `jsonRPC`, `mainnet`). Those words also occur inside node texts the drivers classify
+ * ("method not found" holds `eth`, a JSON-RPC body holds `jsonrpc`), so scrubbing them would
+ * change a verdict's input. A secret shorter than 8 characters is still removed wherever
+ * the whole URL, the whole header value or the whole `Scheme token` appears.
+ */
+export declare const MIN_FRAGMENT_LENGTH = 8;
+export interface EndpointSecrets {
+    /** The endpoint URL as configured and as parsed: an error shows its placeholder. */
+    readonly urls: readonly string[];
+    /** Every other text to remove: fragments and whole header values. */
+    readonly fragments: readonly string[];
+}
+/**
+ * The URL forms and fragments of one endpoint: the URL as given and as parsed; its path and
+ * query together; each userinfo part, path segment, query value and fragment (raw and
+ * percent-decoded); each header value whole; the token after an auth scheme, and for
+ * `Basic` the decoded `user:password` and password. Fragments shorter than
+ * `MIN_FRAGMENT_LENGTH` are left out. The input is trusted configuration (its URL already
+ * parsed by the transport).
+ */
+export declare function endpointSecrets(url: string, headers: Readonly<Record<string, string>>): EndpointSecrets;
+/**
+ * A text with every secret of `secrets` replaced, case-insensitively and longest first: a
+ * URL form by `placeholder`, anything else by `[REDACTED]`; then any other URL redacted.
+ * With `limit`, only the first `limit` characters come back, and only a bounded prefix is
+ * read, since a provider's text is untrusted and may be huge: long enough that a secret
+ * starting before the cut is removed whole.
+ */
+export declare function createScrubber(placeholder: string, secrets: EndpointSecrets): (text: string, limit?: number) => string;

package/dist/core/secret/fragments.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIN_FRAGMENT_LENGTH = void 0;
+exports.endpointSecrets = endpointSecrets;
+exports.createScrubber = createScrubber;
+/**
+ * The secret fragments of one endpoint's configuration, and the scrubber that
+ * removes them from every text an error, a `details` field or a `cause` may carry. A
+ * provider that refuses a key often echoes the bare key back ("invalid api key <KEY>"),
+ * without the URL or header around it, so removing only the whole URL or header value is
+ * not enough.
+ */
+const redact_1 = require("./redact");
+const secret_1 = require("./secret");
+/**
+ * The shortest fragment scrubbed on its own. Every built-in keyed preset's key is at least
+ * 32 characters (Alchemy, Infura, Ankr, TronGrid, toncenter), while the ordinary words of an
+ * endpoint URL are shorter than 8 (`v2`, `v3`, `api`, `rpc`, `eth`, `bsc`, `solana`,
+ * `jsonRPC`, `mainnet`). Those words also occur inside node texts the drivers classify
+ * ("method not found" holds `eth`, a JSON-RPC body holds `jsonrpc`), so scrubbing them would
+ * change a verdict's input. A secret shorter than 8 characters is still removed wherever
+ * the whole URL, the whole header value or the whole `Scheme token` appears.
+ */
+exports.MIN_FRAGMENT_LENGTH = 8;
+/** A whole header value shorter than this is left alone. */
+const MIN_VALUE_LENGTH = 4;
+/** `Scheme token` in an `Authorization`-style value (RFC 9110 §11.4). */
+const AUTH_VALUE = /^\s*[A-Za-z][A-Za-z0-9!#$%&'*+.^_`|~-]*\s+(\S+)\s*$/;
+function decoded(text) {
+    try {
+        return decodeURIComponent(text);
+    }
+    catch {
+        return text;
+    }
+}
+function base64Text(text) {
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(text))
+        return undefined;
+    const value = Buffer.from(text, 'base64').toString('utf8');
+    return /^[\x20-\x7e]+$/.test(value) ? value : undefined;
+}
+/**
+ * The URL forms and fragments of one endpoint: the URL as given and as parsed; its path and
+ * query together; each userinfo part, path segment, query value and fragment (raw and
+ * percent-decoded); each header value whole; the token after an auth scheme, and for
+ * `Basic` the decoded `user:password` and password. Fragments shorter than
+ * `MIN_FRAGMENT_LENGTH` are left out. The input is trusted configuration (its URL already
+ * parsed by the transport).
+ */
+function endpointSecrets(url, headers) {
+    const parsed = new URL(url);
+    const urls = [...new Set([url, parsed.href])];
+    const fragments = new Set();
+    const add = (text, min = exports.MIN_FRAGMENT_LENGTH) => {
+        for (const form of [text, decoded(text)])
+            if (form.length >= min)
+                fragments.add(form);
+    };
+    add(`${parsed.pathname}${parsed.search}`, 2);
+    add(parsed.username);
+    add(parsed.password);
+    for (const segment of parsed.pathname.split('/'))
+        add(segment);
+    for (const pair of parsed.search.replace(/^\?/, '').split('&')) {
+        const at = pair.indexOf('=');
+        if (at < 0)
+            continue;
+        const value = pair.slice(at + 1);
+        add(value);
+        add(value.replace(/\+/g, ' '));
+    }
+    add(parsed.hash.replace(/^#/, ''));
+    for (const value of Object.values(headers)) {
+        add(value, MIN_VALUE_LENGTH);
+        const token = AUTH_VALUE.exec(value)?.[1];
+        if (token === undefined)
+            continue;
+        add(token);
+        const basic = /^\s*basic\s/i.test(value) ? base64Text(token) : undefined;
+        if (basic !== undefined) {
+            add(basic);
+            add(basic.slice(basic.indexOf(':') + 1));
+        }
+    }
+    return { urls, fragments: [...fragments] };
+}
+const escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+/**
+ * A text with every secret of `secrets` replaced, case-insensitively and longest first: a
+ * URL form by `placeholder`, anything else by `[REDACTED]`; then any other URL redacted.
+ * With `limit`, only the first `limit` characters come back, and only a bounded prefix is
+ * read, since a provider's text is untrusted and may be huge: long enough that a secret
+ * starting before the cut is removed whole.
+ */
+function createScrubber(placeholder, secrets) {
+    const all = [...secrets.urls, ...secrets.fragments].sort((a, b) => b.length - a.length);
+    const longest = all[0]?.length ?? 0;
+    const urls = new Set(secrets.urls.map((form) => form.toLowerCase()));
+    const pattern = all.length > 0 ? new RegExp(all.map(escape).join('|'), 'gi') : undefined;
+    return (text, limit) => {
+        const input = limit === undefined ? text : text.slice(0, limit + longest);
+        const replaced = pattern
+            ? input.replace(pattern, (match) => urls.has(match.toLowerCase()) ? placeholder : secret_1.REDACTED)
+            : input;
+        const out = (0, redact_1.redactText)(replaced);
+        return limit === undefined ? out : out.slice(0, limit);
+    };
+}
+//# sourceMappingURL=fragments.js.map

package/dist/core/secret/fragments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fragments.js","sourceRoot":"","sources":["../../../src/core/secret/fragments.ts"],"names":[],"mappings":";;;AAwDA,0CAkCC;AAWD,wCAmBC;AAxHD;;;;;;GAMG;AACH,qCAAsC;AACtC,qCAAoC;AAEpC;;;;;;;;GAQG;AACU,QAAA,mBAAmB,GAAG,CAAC,CAAC;AAErC,4DAA4D;AAC5D,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,yEAAyE;AACzE,MAAM,UAAU,GAAG,qDAAqD,CAAC;AASzE,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,eAAe,CAC7B,GAAW,EACX,OAAyC;IAEzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,GAAG,GAAG,2BAAmB,EAAE,EAAE;QACtD,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAAE,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG;gBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC,CAAC;IACF,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7C,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACjC,GAAG,CAAC,KAAK,CAAC,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,GAAG,CAAC,KAAK,CAAC,CAAC;QACX,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,KAAK,CAAC,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAE7E;;;;;;GAMG;AACH,SAAgB,cAAc,CAC5B,WAAmB,EACnB,OAAwB;IAExB,MAAM,GAAG,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GACX,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,OAAO;YACtB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAC/B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAQ,CACvD;YACH,CAAC,CAAC,KAAK,CAAC;QACV,MAAM,GAAG,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The secret fragments of one endpoint's configuration, and the scrubber that\n * removes them from every text an error, a `details` field or a `cause` may carry. A\n * provider that refuses a key often echoes the bare key back (\"invalid api key <KEY>\"),\n * without the URL or header around it, so removing only the whole URL or header value is\n * not enough.\n */\nimport { redactText } from './redact';\nimport { REDACTED } from './secret';\n\n/**\n * The shortest fragment scrubbed on its own. Every built-in keyed preset's key is at least\n * 32 characters (Alchemy, Infura, Ankr, TronGrid, toncenter), while the ordinary words of an\n * endpoint URL are shorter than 8 (`v2`, `v3`, `api`, `rpc`, `eth`, `bsc`, `solana`,\n * `jsonRPC`, `mainnet`). Those words also occur inside node texts the drivers classify\n * (\"method not found\" holds `eth`, a JSON-RPC body holds `jsonrpc`), so scrubbing them would\n * change a verdict's input. A secret shorter than 8 characters is still removed wherever\n * the whole URL, the whole header value or the whole `Scheme token` appears.\n */\nexport const MIN_FRAGMENT_LENGTH = 8;\n\n/** A whole header value shorter than this is left alone. */\nconst MIN_VALUE_LENGTH = 4;\n\n/** `Scheme token` in an `Authorization`-style value (RFC 9110 §11.4). */\nconst AUTH_VALUE = /^\\s*[A-Za-z][A-Za-z0-9!#$%&'*+.^_`|~-]*\\s+(\\S+)\\s*$/;\n\nexport interface EndpointSecrets {\n  /** The endpoint URL as configured and as parsed: an error shows its placeholder. */\n  readonly urls: readonly string[];\n  /** Every other text to remove: fragments and whole header values. */\n  readonly fragments: readonly string[];\n}\n\nfunction decoded(text: string): string {\n  try {\n    return decodeURIComponent(text);\n  } catch {\n    return text;\n  }\n}\n\nfunction base64Text(text: string): string | undefined {\n  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(text)) return undefined;\n  const value = Buffer.from(text, 'base64').toString('utf8');\n  return /^[\\x20-\\x7e]+$/.test(value) ? value : undefined;\n}\n\n/**\n * The URL forms and fragments of one endpoint: the URL as given and as parsed; its path and\n * query together; each userinfo part, path segment, query value and fragment (raw and\n * percent-decoded); each header value whole; the token after an auth scheme, and for\n * `Basic` the decoded `user:password` and password. Fragments shorter than\n * `MIN_FRAGMENT_LENGTH` are left out. The input is trusted configuration (its URL already\n * parsed by the transport).\n */\nexport function endpointSecrets(\n  url: string,\n  headers: Readonly<Record<string, string>>,\n): EndpointSecrets {\n  const parsed = new URL(url);\n  const urls = [...new Set([url, parsed.href])];\n  const fragments = new Set<string>();\n  const add = (text: string, min = MIN_FRAGMENT_LENGTH) => {\n    for (const form of [text, decoded(text)]) if (form.length >= min) fragments.add(form);\n  };\n  add(`${parsed.pathname}${parsed.search}`, 2);\n  add(parsed.username);\n  add(parsed.password);\n  for (const segment of parsed.pathname.split('/')) add(segment);\n  for (const pair of parsed.search.replace(/^\\?/, '').split('&')) {\n    const at = pair.indexOf('=');\n    if (at < 0) continue;\n    const value = pair.slice(at + 1);\n    add(value);\n    add(value.replace(/\\+/g, ' '));\n  }\n  add(parsed.hash.replace(/^#/, ''));\n  for (const value of Object.values(headers)) {\n    add(value, MIN_VALUE_LENGTH);\n    const token = AUTH_VALUE.exec(value)?.[1];\n    if (token === undefined) continue;\n    add(token);\n    const basic = /^\\s*basic\\s/i.test(value) ? base64Text(token) : undefined;\n    if (basic !== undefined) {\n      add(basic);\n      add(basic.slice(basic.indexOf(':') + 1));\n    }\n  }\n  return { urls, fragments: [...fragments] };\n}\n\nconst escape = (text: string) => text.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\n/**\n * A text with every secret of `secrets` replaced, case-insensitively and longest first: a\n * URL form by `placeholder`, anything else by `[REDACTED]`; then any other URL redacted.\n * With `limit`, only the first `limit` characters come back, and only a bounded prefix is\n * read, since a provider's text is untrusted and may be huge: long enough that a secret\n * starting before the cut is removed whole.\n */\nexport function createScrubber(\n  placeholder: string,\n  secrets: EndpointSecrets,\n): (text: string, limit?: number) => string {\n  const all = [...secrets.urls, ...secrets.fragments].sort((a, b) => b.length - a.length);\n  const longest = all[0]?.length ?? 0;\n  const urls = new Set(secrets.urls.map((form) => form.toLowerCase()));\n  const pattern =\n    all.length > 0 ? new RegExp(all.map(escape).join('|'), 'gi') : undefined;\n  return (text, limit) => {\n    const input = limit === undefined ? text : text.slice(0, limit + longest);\n    const replaced = pattern\n      ? input.replace(pattern, (match) =>\n          urls.has(match.toLowerCase()) ? placeholder : REDACTED,\n        )\n      : input;\n    const out = redactText(replaced);\n    return limit === undefined ? out : out.slice(0, limit);\n  };\n}\n"]}

package/dist/core/secret/redact.d.ts

@@ -0,0 +1,10 @@
+import { type Secret } from './secret';
+export declare function redactUrl(url: string | Secret<string>): string;
+export declare function redactText(text: string): string;
+export declare function redactHeaders(headers: Readonly<Record<string, string | Secret<string>>> | undefined): Record<string, string>;
+export declare function redactDeep(value: unknown, depth?: number): unknown;
+/**
+ * Copies an error's name/message/code with URLs redacted and without its cause chain.
+ * Total: a throwable that cannot be read or printed yields '[unprintable error]'.
+ */
+export declare function sanitizeError(error: unknown): Error;

package/dist/core/secret/redact.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactUrl = redactUrl;
+exports.redactText = redactText;
+exports.redactHeaders = redactHeaders;
+exports.redactDeep = redactDeep;
+exports.sanitizeError = sanitizeError;
+const secret_1 = require("./secret");
+const SENSITIVE_KEY = /(key|secret|token|password|passphrase|mnemonic|private|seed|authorization|cookie)/i;
+const SENSITIVE_HEADER = /(authorization|api[-_]?key|token|secret|cookie)/i;
+const KEYLIKE_SEGMENT = /^[A-Za-z0-9_-]{16,}$/;
+const URL_IN_TEXT = /\b[a-z][a-z0-9+.-]*:\/\/[^\s'"<>)]+/gi;
+function redactUrl(url) {
+    const isSecretUrl = (0, secret_1.isSecret)(url);
+    const raw = isSecretUrl ? url.reveal() : url;
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        return secret_1.REDACTED;
+    }
+    if (isSecretUrl)
+        return `${parsed.protocol}//${parsed.host}/${secret_1.REDACTED}`;
+    const path = parsed.pathname
+        .split('/')
+        .map((segment) => (KEYLIKE_SEGMENT.test(segment) ? secret_1.REDACTED : segment))
+        .join('/');
+    const keys = [...new Set(parsed.searchParams.keys())];
+    const query = keys.length
+        ? `?${keys.map((k) => `${encodeURIComponent(k)}=${secret_1.REDACTED}`).join('&')}`
+        : '';
+    const auth = parsed.username || parsed.password ? `${secret_1.REDACTED}@` : '';
+    return `${parsed.protocol}//${auth}${parsed.host}${path}${query}`;
+}
+function redactText(text) {
+    return text.replace(URL_IN_TEXT, (match) => {
+        const trailing = match.match(/[.,;:!?\]}]+$/);
+        const trailingStr = trailing ? trailing[0] : '';
+        const url = trailing ? match.slice(0, -trailingStr.length) : match;
+        return redactUrl(url) + trailingStr;
+    });
+}
+function redactHeaders(headers) {
+    const out = {};
+    for (const [name, value] of Object.entries(headers ?? {})) {
+        out[name] =
+            (0, secret_1.isSecret)(value) || SENSITIVE_HEADER.test(name) ? secret_1.REDACTED : value;
+    }
+    return out;
+}
+function redactDeep(value, depth = 8) {
+    return walk(value, depth, new WeakSet());
+}
+function walk(value, depth, seen) {
+    if ((0, secret_1.isSecret)(value))
+        return secret_1.REDACTED;
+    if (typeof value === 'string')
+        return redactText(value);
+    if (typeof value === 'bigint')
+        return value.toString();
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (value instanceof Uint8Array)
+        return `[bytes:${value.length}]`;
+    if (value instanceof Error)
+        return { name: value.name, message: redactText(value.message) };
+    if (seen.has(value))
+        return '[Circular]';
+    if (depth <= 0)
+        return '[Truncated]';
+    seen.add(value);
+    if (Array.isArray(value))
+        return value.map((item) => walk(item, depth - 1, seen));
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+        // Redact if key is sensitive and value is not null/undefined/boolean/number
+        const isPrimitive = item === undefined ||
+            item === null ||
+            typeof item === 'boolean' ||
+            typeof item === 'number';
+        const sensitive = SENSITIVE_KEY.test(key) && !isPrimitive;
+        out[key] = sensitive ? secret_1.REDACTED : walk(item, depth - 1, seen);
+    }
+    return out;
+}
+const UNPRINTABLE = '[unprintable error]';
+/**
+ * Copies an error's name/message/code with URLs redacted and without its cause chain.
+ * Total: a throwable that cannot be read or printed yields '[unprintable error]'.
+ */
+function sanitizeError(error) {
+    try {
+        if (error instanceof Error) {
+            const clean = new Error(redactText(String(error.message)));
+            clean.name = redactText(String(error.name));
+            const code = error.code;
+            if (typeof code === 'string') {
+                clean.code = redactText(code);
+            }
+            clean.stack = `${clean.name}: ${clean.message}`;
+            return clean;
+        }
+        return new Error(redactText(String(error)));
+    }
+    catch {
+        return new Error(UNPRINTABLE);
+    }
+}
+//# sourceMappingURL=redact.js.map