logixia 2.0.0 → 2.0.6

package/dist/secret-config-CmK2wVkr.js

@@ -0,0 +1,272 @@
+// \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+const require_own_property = require("./own-property-BWkibepN.js");
+const require_internal_log = require("./internal-log-By4Govmu.js");
+// src/transports/secret-config.ts
+/**
+* Keeps credentials out of serialized transport output and error text.
+*
+* `protectSecrets()` replaces each listed field with a non-enumerable accessor backed
+* by a WeakMap, whether or not the field is assigned yet, so later assignments (a
+* connection opened on first write, a refreshed token) stay hidden too. It also
+* installs `toJSON()` and a Node inspect hook returning a redacted view: scalar
+* fields stay for debugging, secret-looking keys become '[REDACTED]', URLs lose
+* userinfo, query and fragment. No Node imports, so browser bundles can use it.
+*/
+const REDACTED = "[REDACTED]";
+const INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+const MAX_DEPTH = 4;
+const MIN_SECRET_LENGTH = 4;
+const SCHEME_PREFIX = /^[a-z][a-z0-9+.-]*:\/\//i;
+/** `scheme://userinfo@`: userinfo runs to the LAST `@` before the path, so `p@ss` is covered. */
+const USERINFO = /(\b[a-z][a-z0-9+.-]*:\/\/)[^\s/?#]*@/gi;
+function normalizeName(name) {
+	return name.toLowerCase().replaceAll("-", "").replaceAll("_", "");
+}
+const SECRET_NAMES = [...require_internal_log.SENSITIVE_KEY_NAMES, ...require_internal_log.TRANSPORT_CONFIG_SECRET_NAMES].map(normalizeName);
+const QUERY_NAMES = new Set(require_internal_log.DEFAULT_REDACT_QUERY_PARAMS.map(normalizeName));
+/** Exact match for short names (`key`, `pfx`), suffix match for longer ones (`azureClientSecret`). */
+function isSecretKey(key) {
+	const name = normalizeName(key);
+	return SECRET_NAMES.some((n) => name === n || n.length >= 5 && name.endsWith(n));
+}
+function isUrlKey(key) {
+	return /url|uri|endpoint|href/i.test(key);
+}
+function isPlainObject(value) {
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+function safeDecode(value) {
+	try {
+		return decodeURIComponent(value.replaceAll("+", " "));
+	} catch {
+		return value;
+	}
+}
+/** Absolute URL: `scheme://host` only. Relative or unparseable: path kept, query and fragment cut. */
+function redactUrl(raw) {
+	if (typeof raw !== "string") return `${raw.protocol}//${raw.host}`;
+	if (SCHEME_PREFIX.test(raw)) try {
+		const url = new URL(raw);
+		return `${url.protocol}//${url.host}`;
+	} catch {
+		return REDACTED;
+	}
+	return raw.split(/[?#]/, 1)[0] ?? "";
+}
+function redactHeaders(headers) {
+	if (!headers || typeof headers !== "object") return headers;
+	return Object.fromEntries(Object.keys(headers).map((name) => [name, REDACTED]));
+}
+/** Redacted deep copy of a config-like value. Never throws, never returns a secret. */
+function redactConfig(value, depth = 0, key = "") {
+	var _value$constructor;
+	if (value === null || value === void 0) return value;
+	if (typeof value === "string") return SCHEME_PREFIX.test(value) || isUrlKey(key) ? redactUrl(value) : value;
+	if (typeof value === "number" || typeof value === "boolean") return value;
+	if (typeof value === "function") return "[Function]";
+	if (typeof value !== "object") return "[Unserializable]";
+	if (typeof URL !== "undefined" && value instanceof URL) return redactUrl(value);
+	if (Array.isArray(value)) return depth >= MAX_DEPTH ? "[Array]" : value.map((v) => redactConfig(v, depth + 1, key));
+	if (!isPlainObject(value) || depth >= MAX_DEPTH) return `[${((_value$constructor = value.constructor) === null || _value$constructor === void 0 ? void 0 : _value$constructor.name) ?? "Object"}]`;
+	const out = {};
+	for (const [name, inner] of Object.entries(value)) if (isSecretKey(name)) require_own_property.assignOwn(out, name, inner === void 0 ? void 0 : REDACTED);
+	else if (name.toLowerCase() === "headers") require_own_property.assignOwn(out, name, redactHeaders(inner));
+	else require_own_property.assignOwn(out, name, redactConfig(inner, depth + 1, name));
+	return out;
+}
+const hiddenKeys = /* @__PURE__ */ new WeakMap();
+const hiddenValues = /* @__PURE__ */ new WeakMap();
+function viewOf(target) {
+	var _target$constructor;
+	const hidden = hiddenKeys.get(target) ?? /* @__PURE__ */ new Set();
+	const values = hiddenValues.get(target);
+	const view = { class: (_target$constructor = target.constructor) === null || _target$constructor === void 0 ? void 0 : _target$constructor.name };
+	for (const key of /* @__PURE__ */ new Set([...Object.keys(target), ...hidden])) {
+		const inner = hidden.has(key) ? values === null || values === void 0 ? void 0 : values.get(key) : target[key];
+		if (isSecretKey(key)) view[key] = inner === void 0 ? void 0 : REDACTED;
+		else if (key.toLowerCase() === "headers") view[key] = redactHeaders(inner);
+		else if (inner !== null && typeof inner === "object" && !hidden.has(key) && !(inner instanceof URL)) view[key] = "[Object]";
+		else if (hidden.has(key) && typeof inner === "string" && !isUrlKey(key)) view[key] = REDACTED;
+		else view[key] = redactConfig(inner, 0, key);
+	}
+	return view;
+}
+/**
+* Hides `keys` on `target` (assigned or not yet) and gives it a redacted `toJSON()` /
+* inspect view. Fields stay readable and writable. Safe to call more than once.
+* Throws when the target cannot carry the protection (frozen or sealed), instead of
+* silently leaving the secret enumerable.
+*/
+function protectSecrets(target, keys) {
+	if (!Object.isExtensible(target)) {
+		var _target$constructor2;
+		throw new TypeError(`protectSecrets: ${((_target$constructor2 = target.constructor) === null || _target$constructor2 === void 0 ? void 0 : _target$constructor2.name) ?? "object"} is not extensible`);
+	}
+	let hidden = hiddenKeys.get(target);
+	let values = hiddenValues.get(target);
+	if (!hidden || !values) {
+		hidden = /* @__PURE__ */ new Set();
+		values = /* @__PURE__ */ new Map();
+		hiddenKeys.set(target, hidden);
+		hiddenValues.set(target, values);
+		const view = () => viewOf(target);
+		Object.defineProperty(target, "toJSON", {
+			value: view,
+			enumerable: false,
+			configurable: true
+		});
+		Object.defineProperty(target, INSPECT_CUSTOM, {
+			value: view,
+			enumerable: false,
+			configurable: true
+		});
+	}
+	const store = values;
+	for (const key of keys) {
+		if (hidden.has(key)) continue;
+		const desc = Object.getOwnPropertyDescriptor(target, key);
+		if (desc && !desc.configurable) throw new TypeError(`protectSecrets: "${key}" is not configurable`);
+		if (desc && "value" in desc) store.set(key, desc.value);
+		hidden.add(key);
+		Object.defineProperty(target, key, {
+			enumerable: false,
+			configurable: true,
+			get: () => store.get(key),
+			set: (next) => void store.set(key, next)
+		});
+	}
+}
+/** The raw, decoded and percent-encoded spellings of a secret. */
+function variantsOf(secret) {
+	return [
+		secret,
+		safeDecode(secret),
+		encodeURIComponent(secret),
+		encodeURI(secret)
+	];
+}
+/** Secret parts of a URL string: the password and the values of sensitive query parameters. */
+function urlSecrets(raw) {
+	const text = typeof raw === "string" ? raw : raw.href;
+	const out = [];
+	const userinfo = new RegExp(USERINFO.source, "i").exec(text);
+	if (userinfo) {
+		const info = text.slice(userinfo[1].length, userinfo.index + userinfo[0].length - 1);
+		const colon = info.indexOf(":");
+		if (colon !== -1) out.push(info.slice(colon + 1));
+	}
+	const queryStart = text.indexOf("?");
+	if (queryStart !== -1) {
+		const query = text.slice(queryStart + 1).split("#", 1)[0] ?? "";
+		for (const pair of query.split("&")) {
+			const eq = pair.indexOf("=");
+			if (eq > 0 && QUERY_NAMES.has(normalizeName(safeDecode(pair.slice(0, eq))))) out.push(pair.slice(eq + 1));
+		}
+	}
+	return out.flatMap(variantsOf);
+}
+/** Every secret string held in a config-like value: secret-keyed values, header values, URL secrets. */
+function collectSecrets(value, depth = 0, key = "") {
+	if (typeof value === "string") {
+		if (isSecretKey(key)) return [value];
+		return SCHEME_PREFIX.test(value) || isUrlKey(key) ? urlSecrets(value) : [];
+	}
+	if (!value || typeof value !== "object" || depth > MAX_DEPTH) return [];
+	if (typeof URL !== "undefined" && value instanceof URL) return urlSecrets(value);
+	if (Array.isArray(value)) return value.flatMap((v) => collectSecrets(v, depth + 1, key));
+	if (!isPlainObject(value)) return [];
+	const isHeaders = key.toLowerCase() === "headers";
+	return Object.entries(value).flatMap(([name, inner]) => {
+		if (isHeaders && typeof inner === "string") return [inner];
+		if (isSecretKey(name) && inner !== null && typeof inner === "object") return collectSecrets(inner, depth + 1, "secret");
+		return collectSecrets(inner, depth + 1, name);
+	});
+}
+/** Replaces URL userinfo and every spelling of the given secret values in `text`. */
+function scrubSecrets(text, secrets) {
+	let out = text.replace(USERINFO, `$1${REDACTED}@`);
+	const all = new Set(secrets.flatMap((s) => s && s.length >= MIN_SECRET_LENGTH ? variantsOf(s) : []));
+	for (const secret of [...all].sort((a, b) => b.length - a.length)) if (secret.length >= MIN_SECRET_LENGTH) out = out.split(secret).join(REDACTED);
+	return out;
+}
+/** Scrubs message, stack and the cause chain of `err` in place; returns it. */
+function scrubError(err, secrets, depth = 0) {
+	if (!(err instanceof Error) || depth > 3) return err;
+	try {
+		err.message = scrubSecrets(err.message, secrets);
+		if (err.stack) err.stack = scrubSecrets(err.stack, secrets);
+		scrubError(err.cause, secrets, depth + 1);
+	} catch {}
+	return err;
+}
+/** A `.catch()` handler that scrubs the secrets from the error, then rethrows it. */
+function scrubbing(secrets) {
+	return (err) => {
+		throw scrubError(err, secrets());
+	};
+}
+Object.defineProperty(exports, "__toESM", {
+	enumerable: true,
+	get: function() {
+		return __toESM;
+	}
+});
+Object.defineProperty(exports, "collectSecrets", {
+	enumerable: true,
+	get: function() {
+		return collectSecrets;
+	}
+});
+Object.defineProperty(exports, "protectSecrets", {
+	enumerable: true,
+	get: function() {
+		return protectSecrets;
+	}
+});
+Object.defineProperty(exports, "scrubError", {
+	enumerable: true,
+	get: function() {
+		return scrubError;
+	}
+});
+Object.defineProperty(exports, "scrubSecrets", {
+	enumerable: true,
+	get: function() {
+		return scrubSecrets;
+	}
+});
+Object.defineProperty(exports, "scrubbing", {
+	enumerable: true,
+	get: function() {
+		return scrubbing;
+	}
+});
+Object.defineProperty(exports, "urlSecrets", {
+	enumerable: true,
+	get: function() {
+		return urlSecrets;
+	}
+});
+
+//# sourceMappingURL=secret-config-CmK2wVkr.js.map

package/dist/secret-config-CmK2wVkr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-config-CmK2wVkr.js","names":["SENSITIVE_KEY_NAMES","TRANSPORT_CONFIG_SECRET_NAMES","DEFAULT_REDACT_QUERY_PARAMS"],"sources":["../src/transports/secret-config.ts"],"sourcesContent":["/**\n * Keeps credentials out of serialized transport output and error text.\n *\n * `protectSecrets()` replaces each listed field with a non-enumerable accessor backed\n * by a WeakMap, whether or not the field is assigned yet, so later assignments (a\n * connection opened on first write, a refreshed token) stay hidden too. It also\n * installs `toJSON()` and a Node inspect hook returning a redacted view: scalar\n * fields stay for debugging, secret-looking keys become '[REDACTED]', URLs lose\n * userinfo, query and fragment. No Node imports, so browser bundles can use it.\n */\n\nimport { assignOwn } from '../utils/own-property';\nimport {\n  DEFAULT_REDACT_QUERY_PARAMS,\n  SENSITIVE_KEY_NAMES,\n  TRANSPORT_CONFIG_SECRET_NAMES,\n} from '../utils/sensitive-names';\n\nexport const REDACTED = '[REDACTED]';\n\nconst INSPECT_CUSTOM = Symbol.for('nodejs.util.inspect.custom');\nconst MAX_DEPTH = 4;\nconst MIN_SECRET_LENGTH = 4;\nconst SCHEME_PREFIX = /^[a-z][a-z0-9+.-]*:\\/\\//i;\n/** `scheme://userinfo@`: userinfo runs to the LAST `@` before the path, so `p@ss` is covered. */\nconst USERINFO = /(\\b[a-z][a-z0-9+.-]*:\\/\\/)[^\\s/?#]*@/gi;\n\nfunction normalizeName(name: string): string {\n  return name.toLowerCase().replaceAll('-', '').replaceAll('_', '');\n}\n\nconst SECRET_NAMES = [...SENSITIVE_KEY_NAMES, ...TRANSPORT_CONFIG_SECRET_NAMES].map(normalizeName);\nconst QUERY_NAMES = new Set(DEFAULT_REDACT_QUERY_PARAMS.map(normalizeName));\n\n/** Exact match for short names (`key`, `pfx`), suffix match for longer ones (`azureClientSecret`). */\nfunction isSecretKey(key: string): boolean {\n  const name = normalizeName(key);\n  return SECRET_NAMES.some((n) => name === n || (n.length >= 5 && name.endsWith(n)));\n}\n\nfunction isUrlKey(key: string): boolean {\n  return /url|uri|endpoint|href/i.test(key);\n}\n\nfunction isPlainObject(value: object): boolean {\n  const proto = Object.getPrototypeOf(value) as unknown;\n  return proto === Object.prototype || proto === null;\n}\n\nfunction safeDecode(value: string): string {\n  try {\n    return decodeURIComponent(value.replaceAll('+', ' '));\n  } catch {\n    return value;\n  }\n}\n\n/** Absolute URL: `scheme://host` only. Relative or unparseable: path kept, query and fragment cut. */\nexport function redactUrl(raw: string | URL): string {\n  if (typeof raw !== 'string') return `${raw.protocol}//${raw.host}`;\n  if (SCHEME_PREFIX.test(raw)) {\n    try {\n      const url = new URL(raw);\n      return `${url.protocol}//${url.host}`;\n    } catch {\n      return REDACTED;\n    }\n  }\n  return raw.split(/[?#]/, 1)[0] ?? '';\n}\n\nfunction redactHeaders(headers: unknown): unknown {\n  if (!headers || typeof headers !== 'object') return headers;\n  return Object.fromEntries(Object.keys(headers).map((name) => [name, REDACTED]));\n}\n\n/** Redacted deep copy of a config-like value. Never throws, never returns a secret. */\nexport function redactConfig(value: unknown, depth = 0, key = ''): unknown {\n  if (value === null || value === undefined) return value;\n  if (typeof value === 'string') {\n    return SCHEME_PREFIX.test(value) || isUrlKey(key) ? redactUrl(value) : value;\n  }\n  if (typeof value === 'number' || typeof value === 'boolean') return value;\n  if (typeof value === 'function') return '[Function]';\n  if (typeof value !== 'object') return '[Unserializable]';\n  if (typeof URL !== 'undefined' && value instanceof URL) return redactUrl(value);\n  if (Array.isArray(value)) {\n    return depth >= MAX_DEPTH ? '[Array]' : value.map((v) => redactConfig(v, depth + 1, key));\n  }\n  if (!isPlainObject(value) || depth >= MAX_DEPTH)\n    return `[${value.constructor?.name ?? 'Object'}]`;\n  const out: Record<string, unknown> = {};\n  for (const [name, inner] of Object.entries(value)) {\n    if (isSecretKey(name)) assignOwn(out, name, inner === undefined ? undefined : REDACTED);\n    else if (name.toLowerCase() === 'headers') assignOwn(out, name, redactHeaders(inner));\n    else assignOwn(out, name, redactConfig(inner, depth + 1, name));\n  }\n  return out;\n}\n\n// ── Secret protection ───────────────────────────────────────────────────────\n\nconst hiddenKeys = new WeakMap<object, Set<string>>();\nconst hiddenValues = new WeakMap<object, Map<string, unknown>>();\n\nfunction viewOf(target: object): Record<string, unknown> {\n  const hidden = hiddenKeys.get(target) ?? new Set<string>();\n  const values = hiddenValues.get(target);\n  const view: Record<string, unknown> = { class: target.constructor?.name };\n  for (const key of new Set([...Object.keys(target), ...hidden])) {\n    const inner = hidden.has(key) ? values?.get(key) : (target as Record<string, unknown>)[key];\n    if (isSecretKey(key)) view[key] = inner === undefined ? undefined : REDACTED;\n    else if (key.toLowerCase() === 'headers') view[key] = redactHeaders(inner);\n    else if (\n      inner !== null &&\n      typeof inner === 'object' &&\n      !hidden.has(key) &&\n      !(inner instanceof URL)\n    ) {\n      view[key] = '[Object]';\n    } else if (hidden.has(key) && typeof inner === 'string' && !isUrlKey(key)) {\n      view[key] = REDACTED;\n    } else view[key] = redactConfig(inner, 0, key);\n  }\n  return view;\n}\n\n/**\n * Hides `keys` on `target` (assigned or not yet) and gives it a redacted `toJSON()` /\n * inspect view. Fields stay readable and writable. Safe to call more than once.\n * Throws when the target cannot carry the protection (frozen or sealed), instead of\n * silently leaving the secret enumerable.\n */\nexport function protectSecrets(target: object, keys: readonly string[]): void {\n  if (!Object.isExtensible(target)) {\n    throw new TypeError(\n      `protectSecrets: ${target.constructor?.name ?? 'object'} is not extensible`\n    );\n  }\n  let hidden = hiddenKeys.get(target);\n  let values = hiddenValues.get(target);\n  if (!hidden || !values) {\n    hidden = new Set();\n    values = new Map();\n    hiddenKeys.set(target, hidden);\n    hiddenValues.set(target, values);\n    const view = (): Record<string, unknown> => viewOf(target);\n    Object.defineProperty(target, 'toJSON', { value: view, enumerable: false, configurable: true });\n    Object.defineProperty(target, INSPECT_CUSTOM, {\n      value: view,\n      enumerable: false,\n      configurable: true,\n    });\n  }\n  const store = values;\n  for (const key of keys) {\n    if (hidden.has(key)) continue;\n    const desc = Object.getOwnPropertyDescriptor(target, key);\n    if (desc && !desc.configurable) {\n      throw new TypeError(`protectSecrets: \"${key}\" is not configurable`);\n    }\n    if (desc && 'value' in desc) store.set(key, desc.value);\n    hidden.add(key);\n    Object.defineProperty(target, key, {\n      enumerable: false,\n      configurable: true,\n      get: () => store.get(key),\n      set: (next: unknown) => void store.set(key, next),\n    });\n  }\n}\n\n// ── Scrubbing error text ────────────────────────────────────────────────────\n\n/** The raw, decoded and percent-encoded spellings of a secret. */\nfunction variantsOf(secret: string): string[] {\n  return [secret, safeDecode(secret), encodeURIComponent(secret), encodeURI(secret)];\n}\n\n/** Secret parts of a URL string: the password and the values of sensitive query parameters. */\nexport function urlSecrets(raw: string | URL): string[] {\n  const text = typeof raw === 'string' ? raw : raw.href;\n  const out: string[] = [];\n  const userinfo = new RegExp(USERINFO.source, 'i').exec(text);\n  if (userinfo) {\n    const info = text.slice(userinfo[1]!.length, userinfo.index + userinfo[0].length - 1);\n    const colon = info.indexOf(':');\n    if (colon !== -1) out.push(info.slice(colon + 1));\n  }\n  const queryStart = text.indexOf('?');\n  if (queryStart !== -1) {\n    const query = text.slice(queryStart + 1).split('#', 1)[0] ?? '';\n    for (const pair of query.split('&')) {\n      const eq = pair.indexOf('=');\n      if (eq > 0 && QUERY_NAMES.has(normalizeName(safeDecode(pair.slice(0, eq))))) {\n        out.push(pair.slice(eq + 1));\n      }\n    }\n  }\n  return out.flatMap(variantsOf);\n}\n\n/** Every secret string held in a config-like value: secret-keyed values, header values, URL secrets. */\nexport function collectSecrets(value: unknown, depth = 0, key = ''): string[] {\n  if (typeof value === 'string') {\n    if (isSecretKey(key)) return [value];\n    return SCHEME_PREFIX.test(value) || isUrlKey(key) ? urlSecrets(value) : [];\n  }\n  if (!value || typeof value !== 'object' || depth > MAX_DEPTH) return [];\n  if (typeof URL !== 'undefined' && value instanceof URL) return urlSecrets(value);\n  if (Array.isArray(value)) return value.flatMap((v) => collectSecrets(v, depth + 1, key));\n  if (!isPlainObject(value)) return [];\n  const isHeaders = key.toLowerCase() === 'headers';\n  return Object.entries(value).flatMap(([name, inner]) => {\n    if (isHeaders && typeof inner === 'string') return [inner];\n    if (isSecretKey(name) && inner !== null && typeof inner === 'object') {\n      return collectSecrets(inner, depth + 1, 'secret');\n    }\n    return collectSecrets(inner, depth + 1, name);\n  });\n}\n\n/** Replaces URL userinfo and every spelling of the given secret values in `text`. */\nexport function scrubSecrets(text: string, secrets: readonly (string | undefined)[]): string {\n  let out = text.replace(USERINFO, `$1${REDACTED}@`);\n  const all = new Set(\n    secrets.flatMap((s) => (s && s.length >= MIN_SECRET_LENGTH ? variantsOf(s) : []))\n  );\n  for (const secret of [...all].sort((a, b) => b.length - a.length)) {\n    if (secret.length >= MIN_SECRET_LENGTH) out = out.split(secret).join(REDACTED);\n  }\n  return out;\n}\n\n/** Scrubs message, stack and the cause chain of `err` in place; returns it. */\nexport function scrubError<T>(err: T, secrets: readonly (string | undefined)[], depth = 0): T {\n  if (!(err instanceof Error) || depth > 3) return err;\n  try {\n    err.message = scrubSecrets(err.message, secrets);\n    if (err.stack) err.stack = scrubSecrets(err.stack, secrets);\n    scrubError((err as { cause?: unknown }).cause, secrets, depth + 1);\n  } catch {\n    /* frozen error: leave as is */\n  }\n  return err;\n}\n\n/** A `.catch()` handler that scrubs the secrets from the error, then rethrows it. */\nexport function scrubbing(secrets: () => (string | undefined)[]): (err: unknown) => never {\n  return (err) => {\n    throw scrubError(err, secrets());\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,MAAa,WAAW;AAExB,MAAM,iBAAiB,OAAO,IAAI,4BAA4B;AAC9D,MAAM,YAAY;AAClB,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;;AAEtB,MAAM,WAAW;AAEjB,SAAS,cAAc,MAAsB;CAC3C,OAAO,KAAK,YAAY,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,WAAW,KAAK,EAAE;AAClE;AAEA,MAAM,eAAe,CAAC,GAAGA,qBAAAA,qBAAqB,GAAGC,qBAAAA,6BAA6B,CAAC,CAAC,IAAI,aAAa;AACjG,MAAM,cAAc,IAAI,IAAIC,qBAAAA,4BAA4B,IAAI,aAAa,CAAC;;AAG1E,SAAS,YAAY,KAAsB;CACzC,MAAM,OAAO,cAAc,GAAG;CAC9B,OAAO,aAAa,MAAM,MAAM,SAAS,KAAM,EAAE,UAAU,KAAK,KAAK,SAAS,CAAC,CAAE;AACnF;AAEA,SAAS,SAAS,KAAsB;CACtC,OAAO,yBAAyB,KAAK,GAAG;AAC1C;AAEA,SAAS,cAAc,OAAwB;CAC7C,MAAM,QAAQ,OAAO,eAAe,KAAK;CACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,SAAS,WAAW,OAAuB;CACzC,IAAI;EACF,OAAO,mBAAmB,MAAM,WAAW,KAAK,GAAG,CAAC;CACtD,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,UAAU,KAA2B;CACnD,IAAI,OAAO,QAAQ,UAAU,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CAC5D,IAAI,cAAc,KAAK,GAAG,GACxB,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,GAAG;EACvB,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN,OAAO;CACT;CAEF,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,MAAM;AACpC;AAEA,SAAS,cAAc,SAA2B;CAChD,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU,OAAO;CACpD,OAAO,OAAO,YAAY,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,QAAQ,CAAC,CAAC;AAChF;;AAGA,SAAgB,aAAa,OAAgB,QAAQ,GAAG,MAAM,IAAa;;CACzE,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,OAAO;CAClD,IAAI,OAAO,UAAU,UACnB,OAAO,cAAc,KAAK,KAAK,KAAK,SAAS,GAAG,IAAI,UAAU,KAAK,IAAI;CAEzE,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW,OAAO;CACpE,IAAI,OAAO,UAAU,YAAY,OAAO;CACxC,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,OAAO,QAAQ,eAAe,iBAAiB,KAAK,OAAO,UAAU,KAAK;CAC9E,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,SAAS,YAAY,YAAY,MAAM,KAAK,MAAM,aAAa,GAAG,QAAQ,GAAG,GAAG,CAAC;CAE1F,IAAI,CAAC,cAAc,KAAK,KAAK,SAAS,WACpC,OAAO,MAAA,qBAAI,MAAM,iBAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAa,SAAQ,SAAS;CACjD,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,GAC9C,IAAI,YAAY,IAAI,GAAG,qBAAA,UAAU,KAAK,MAAM,UAAU,KAAA,IAAY,KAAA,IAAY,QAAQ;MACjF,IAAI,KAAK,YAAY,MAAM,WAAW,qBAAA,UAAU,KAAK,MAAM,cAAc,KAAK,CAAC;MAC/E,qBAAA,UAAU,KAAK,MAAM,aAAa,OAAO,QAAQ,GAAG,IAAI,CAAC;CAEhE,OAAO;AACT;AAIA,MAAM,6BAAa,IAAI,QAA6B;AACpD,MAAM,+BAAe,IAAI,QAAsC;AAE/D,SAAS,OAAO,QAAyC;;CACvD,MAAM,SAAS,WAAW,IAAI,MAAM,qBAAK,IAAI,IAAY;CACzD,MAAM,SAAS,aAAa,IAAI,MAAM;CACtC,MAAM,OAAgC,EAAE,QAAA,sBAAO,OAAO,iBAAA,QAAA,wBAAA,KAAA,IAAA,KAAA,IAAA,oBAAa,KAAK;CACxE,KAAK,MAAM,uBAAO,IAAI,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;EAC9D,MAAM,QAAQ,OAAO,IAAI,GAAG,IAAA,WAAA,QAAA,WAAA,KAAA,IAAA,KAAA,IAAI,OAAQ,IAAI,GAAG,IAAK,OAAmC;EACvF,IAAI,YAAY,GAAG,GAAG,KAAK,OAAO,UAAU,KAAA,IAAY,KAAA,IAAY;OAC/D,IAAI,IAAI,YAAY,MAAM,WAAW,KAAK,OAAO,cAAc,KAAK;OACpE,IACH,UAAU,QACV,OAAO,UAAU,YACjB,CAAC,OAAO,IAAI,GAAG,KACf,EAAE,iBAAiB,MAEnB,KAAK,OAAO;OACP,IAAI,OAAO,IAAI,GAAG,KAAK,OAAO,UAAU,YAAY,CAAC,SAAS,GAAG,GACtE,KAAK,OAAO;OACP,KAAK,OAAO,aAAa,OAAO,GAAG,GAAG;CAC/C;CACA,OAAO;AACT;;;;;;;AAQA,SAAgB,eAAe,QAAgB,MAA+B;CAC5E,IAAI,CAAC,OAAO,aAAa,MAAM,GAAG;;EAChC,MAAM,IAAI,UACR,qBAAA,uBAAmB,OAAO,iBAAA,QAAA,yBAAA,KAAA,IAAA,KAAA,IAAA,qBAAa,SAAQ,SAAS,mBAC1D;CACF;CACA,IAAI,SAAS,WAAW,IAAI,MAAM;CAClC,IAAI,SAAS,aAAa,IAAI,MAAM;CACpC,IAAI,CAAC,UAAU,CAAC,QAAQ;EACtB,yBAAS,IAAI,IAAI;EACjB,yBAAS,IAAI,IAAI;EACjB,WAAW,IAAI,QAAQ,MAAM;EAC7B,aAAa,IAAI,QAAQ,MAAM;EAC/B,MAAM,aAAsC,OAAO,MAAM;EACzD,OAAO,eAAe,QAAQ,UAAU;GAAE,OAAO;GAAM,YAAY;GAAO,cAAc;EAAK,CAAC;EAC9F,OAAO,eAAe,QAAQ,gBAAgB;GAC5C,OAAO;GACP,YAAY;GACZ,cAAc;EAChB,CAAC;CACH;CACA,MAAM,QAAQ;CACd,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,OAAO,IAAI,GAAG,GAAG;EACrB,MAAM,OAAO,OAAO,yBAAyB,QAAQ,GAAG;EACxD,IAAI,QAAQ,CAAC,KAAK,cAChB,MAAM,IAAI,UAAU,oBAAoB,IAAI,sBAAsB;EAEpE,IAAI,QAAQ,WAAW,MAAM,MAAM,IAAI,KAAK,KAAK,KAAK;EACtD,OAAO,IAAI,GAAG;EACd,OAAO,eAAe,QAAQ,KAAK;GACjC,YAAY;GACZ,cAAc;GACd,WAAW,MAAM,IAAI,GAAG;GACxB,MAAM,SAAkB,KAAK,MAAM,IAAI,KAAK,IAAI;EAClD,CAAC;CACH;AACF;;AAKA,SAAS,WAAW,QAA0B;CAC5C,OAAO;EAAC;EAAQ,WAAW,MAAM;EAAG,mBAAmB,MAAM;EAAG,UAAU,MAAM;CAAC;AACnF;;AAGA,SAAgB,WAAW,KAA6B;CACtD,MAAM,OAAO,OAAO,QAAQ,WAAW,MAAM,IAAI;CACjD,MAAM,MAAgB,CAAC;CACvB,MAAM,WAAW,IAAI,OAAO,SAAS,QAAQ,GAAG,CAAC,CAAC,KAAK,IAAI;CAC3D,IAAI,UAAU;EACZ,MAAM,OAAO,KAAK,MAAM,SAAS,EAAE,CAAE,QAAQ,SAAS,QAAQ,SAAS,EAAE,CAAC,SAAS,CAAC;EACpF,MAAM,QAAQ,KAAK,QAAQ,GAAG;EAC9B,IAAI,UAAU,IAAI,IAAI,KAAK,KAAK,MAAM,QAAQ,CAAC,CAAC;CAClD;CACA,MAAM,aAAa,KAAK,QAAQ,GAAG;CACnC,IAAI,eAAe,IAAI;EACrB,MAAM,QAAQ,KAAK,MAAM,aAAa,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM;EAC7D,KAAK,MAAM,QAAQ,MAAM,MAAM,GAAG,GAAG;GACnC,MAAM,KAAK,KAAK,QAAQ,GAAG;GAC3B,IAAI,KAAK,KAAK,YAAY,IAAI,cAAc,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GACxE,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC;EAE/B;CACF;CACA,OAAO,IAAI,QAAQ,UAAU;AAC/B;;AAGA,SAAgB,eAAe,OAAgB,QAAQ,GAAG,MAAM,IAAc;CAC5E,IAAI,OAAO,UAAU,UAAU;EAC7B,IAAI,YAAY,GAAG,GAAG,OAAO,CAAC,KAAK;EACnC,OAAO,cAAc,KAAK,KAAK,KAAK,SAAS,GAAG,IAAI,WAAW,KAAK,IAAI,CAAC;CAC3E;CACA,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,QAAQ,WAAW,OAAO,CAAC;CACtE,IAAI,OAAO,QAAQ,eAAe,iBAAiB,KAAK,OAAO,WAAW,KAAK;CAC/E,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,SAAS,MAAM,eAAe,GAAG,QAAQ,GAAG,GAAG,CAAC;CACvF,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,CAAC;CACnC,MAAM,YAAY,IAAI,YAAY,MAAM;CACxC,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,WAAW;EACtD,IAAI,aAAa,OAAO,UAAU,UAAU,OAAO,CAAC,KAAK;EACzD,IAAI,YAAY,IAAI,KAAK,UAAU,QAAQ,OAAO,UAAU,UAC1D,OAAO,eAAe,OAAO,QAAQ,GAAG,QAAQ;EAElD,OAAO,eAAe,OAAO,QAAQ,GAAG,IAAI;CAC9C,CAAC;AACH;;AAGA,SAAgB,aAAa,MAAc,SAAkD;CAC3F,IAAI,MAAM,KAAK,QAAQ,UAAU,KAAK,SAAS,EAAE;CACjD,MAAM,MAAM,IAAI,IACd,QAAQ,SAAS,MAAO,KAAK,EAAE,UAAU,oBAAoB,WAAW,CAAC,IAAI,CAAC,CAAE,CAClF;CACA,KAAK,MAAM,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAC9D,IAAI,OAAO,UAAU,mBAAmB,MAAM,IAAI,MAAM,MAAM,CAAC,CAAC,KAAK,QAAQ;CAE/E,OAAO;AACT;;AAGA,SAAgB,WAAc,KAAQ,SAA0C,QAAQ,GAAM;CAC5F,IAAI,EAAE,eAAe,UAAU,QAAQ,GAAG,OAAO;CACjD,IAAI;EACF,IAAI,UAAU,aAAa,IAAI,SAAS,OAAO;EAC/C,IAAI,IAAI,OAAO,IAAI,QAAQ,aAAa,IAAI,OAAO,OAAO;EAC1D,WAAY,IAA4B,OAAO,SAAS,QAAQ,CAAC;CACnE,QAAQ,CAER;CACA,OAAO;AACT;;AAGA,SAAgB,UAAU,SAAgE;CACxF,QAAQ,QAAQ;EACd,MAAM,WAAW,KAAK,QAAQ,CAAC;CACjC;AACF"}

package/dist/secret-config-Dhb6pqTU.mjs

@@ -0,0 +1,210 @@
+import { t as assignOwn } from "./own-property-CjFw9qwZ.mjs";
+import { a as DEFAULT_REDACT_QUERY_PARAMS, o as SENSITIVE_KEY_NAMES, s as TRANSPORT_CONFIG_SECRET_NAMES } from "./internal-log-Bg4V1cPg.mjs";
+// src/transports/secret-config.ts
+/**
+* Keeps credentials out of serialized transport output and error text.
+*
+* `protectSecrets()` replaces each listed field with a non-enumerable accessor backed
+* by a WeakMap, whether or not the field is assigned yet, so later assignments (a
+* connection opened on first write, a refreshed token) stay hidden too. It also
+* installs `toJSON()` and a Node inspect hook returning a redacted view: scalar
+* fields stay for debugging, secret-looking keys become '[REDACTED]', URLs lose
+* userinfo, query and fragment. No Node imports, so browser bundles can use it.
+*/
+const REDACTED = "[REDACTED]";
+const INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+const MAX_DEPTH = 4;
+const MIN_SECRET_LENGTH = 4;
+const SCHEME_PREFIX = /^[a-z][a-z0-9+.-]*:\/\//i;
+/** `scheme://userinfo@`: userinfo runs to the LAST `@` before the path, so `p@ss` is covered. */
+const USERINFO = /(\b[a-z][a-z0-9+.-]*:\/\/)[^\s/?#]*@/gi;
+function normalizeName(name) {
+	return name.toLowerCase().replaceAll("-", "").replaceAll("_", "");
+}
+const SECRET_NAMES = [...SENSITIVE_KEY_NAMES, ...TRANSPORT_CONFIG_SECRET_NAMES].map(normalizeName);
+const QUERY_NAMES = new Set(DEFAULT_REDACT_QUERY_PARAMS.map(normalizeName));
+/** Exact match for short names (`key`, `pfx`), suffix match for longer ones (`azureClientSecret`). */
+function isSecretKey(key) {
+	const name = normalizeName(key);
+	return SECRET_NAMES.some((n) => name === n || n.length >= 5 && name.endsWith(n));
+}
+function isUrlKey(key) {
+	return /url|uri|endpoint|href/i.test(key);
+}
+function isPlainObject(value) {
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+function safeDecode(value) {
+	try {
+		return decodeURIComponent(value.replaceAll("+", " "));
+	} catch {
+		return value;
+	}
+}
+/** Absolute URL: `scheme://host` only. Relative or unparseable: path kept, query and fragment cut. */
+function redactUrl(raw) {
+	if (typeof raw !== "string") return `${raw.protocol}//${raw.host}`;
+	if (SCHEME_PREFIX.test(raw)) try {
+		const url = new URL(raw);
+		return `${url.protocol}//${url.host}`;
+	} catch {
+		return REDACTED;
+	}
+	return raw.split(/[?#]/, 1)[0] ?? "";
+}
+function redactHeaders(headers) {
+	if (!headers || typeof headers !== "object") return headers;
+	return Object.fromEntries(Object.keys(headers).map((name) => [name, REDACTED]));
+}
+/** Redacted deep copy of a config-like value. Never throws, never returns a secret. */
+function redactConfig(value, depth = 0, key = "") {
+	var _value$constructor;
+	if (value === null || value === void 0) return value;
+	if (typeof value === "string") return SCHEME_PREFIX.test(value) || isUrlKey(key) ? redactUrl(value) : value;
+	if (typeof value === "number" || typeof value === "boolean") return value;
+	if (typeof value === "function") return "[Function]";
+	if (typeof value !== "object") return "[Unserializable]";
+	if (typeof URL !== "undefined" && value instanceof URL) return redactUrl(value);
+	if (Array.isArray(value)) return depth >= MAX_DEPTH ? "[Array]" : value.map((v) => redactConfig(v, depth + 1, key));
+	if (!isPlainObject(value) || depth >= MAX_DEPTH) return `[${((_value$constructor = value.constructor) === null || _value$constructor === void 0 ? void 0 : _value$constructor.name) ?? "Object"}]`;
+	const out = {};
+	for (const [name, inner] of Object.entries(value)) if (isSecretKey(name)) assignOwn(out, name, inner === void 0 ? void 0 : REDACTED);
+	else if (name.toLowerCase() === "headers") assignOwn(out, name, redactHeaders(inner));
+	else assignOwn(out, name, redactConfig(inner, depth + 1, name));
+	return out;
+}
+const hiddenKeys = /* @__PURE__ */ new WeakMap();
+const hiddenValues = /* @__PURE__ */ new WeakMap();
+function viewOf(target) {
+	var _target$constructor;
+	const hidden = hiddenKeys.get(target) ?? /* @__PURE__ */ new Set();
+	const values = hiddenValues.get(target);
+	const view = { class: (_target$constructor = target.constructor) === null || _target$constructor === void 0 ? void 0 : _target$constructor.name };
+	for (const key of /* @__PURE__ */ new Set([...Object.keys(target), ...hidden])) {
+		const inner = hidden.has(key) ? values === null || values === void 0 ? void 0 : values.get(key) : target[key];
+		if (isSecretKey(key)) view[key] = inner === void 0 ? void 0 : REDACTED;
+		else if (key.toLowerCase() === "headers") view[key] = redactHeaders(inner);
+		else if (inner !== null && typeof inner === "object" && !hidden.has(key) && !(inner instanceof URL)) view[key] = "[Object]";
+		else if (hidden.has(key) && typeof inner === "string" && !isUrlKey(key)) view[key] = REDACTED;
+		else view[key] = redactConfig(inner, 0, key);
+	}
+	return view;
+}
+/**
+* Hides `keys` on `target` (assigned or not yet) and gives it a redacted `toJSON()` /
+* inspect view. Fields stay readable and writable. Safe to call more than once.
+* Throws when the target cannot carry the protection (frozen or sealed), instead of
+* silently leaving the secret enumerable.
+*/
+function protectSecrets(target, keys) {
+	if (!Object.isExtensible(target)) {
+		var _target$constructor2;
+		throw new TypeError(`protectSecrets: ${((_target$constructor2 = target.constructor) === null || _target$constructor2 === void 0 ? void 0 : _target$constructor2.name) ?? "object"} is not extensible`);
+	}
+	let hidden = hiddenKeys.get(target);
+	let values = hiddenValues.get(target);
+	if (!hidden || !values) {
+		hidden = /* @__PURE__ */ new Set();
+		values = /* @__PURE__ */ new Map();
+		hiddenKeys.set(target, hidden);
+		hiddenValues.set(target, values);
+		const view = () => viewOf(target);
+		Object.defineProperty(target, "toJSON", {
+			value: view,
+			enumerable: false,
+			configurable: true
+		});
+		Object.defineProperty(target, INSPECT_CUSTOM, {
+			value: view,
+			enumerable: false,
+			configurable: true
+		});
+	}
+	const store = values;
+	for (const key of keys) {
+		if (hidden.has(key)) continue;
+		const desc = Object.getOwnPropertyDescriptor(target, key);
+		if (desc && !desc.configurable) throw new TypeError(`protectSecrets: "${key}" is not configurable`);
+		if (desc && "value" in desc) store.set(key, desc.value);
+		hidden.add(key);
+		Object.defineProperty(target, key, {
+			enumerable: false,
+			configurable: true,
+			get: () => store.get(key),
+			set: (next) => void store.set(key, next)
+		});
+	}
+}
+/** The raw, decoded and percent-encoded spellings of a secret. */
+function variantsOf(secret) {
+	return [
+		secret,
+		safeDecode(secret),
+		encodeURIComponent(secret),
+		encodeURI(secret)
+	];
+}
+/** Secret parts of a URL string: the password and the values of sensitive query parameters. */
+function urlSecrets(raw) {
+	const text = typeof raw === "string" ? raw : raw.href;
+	const out = [];
+	const userinfo = new RegExp(USERINFO.source, "i").exec(text);
+	if (userinfo) {
+		const info = text.slice(userinfo[1].length, userinfo.index + userinfo[0].length - 1);
+		const colon = info.indexOf(":");
+		if (colon !== -1) out.push(info.slice(colon + 1));
+	}
+	const queryStart = text.indexOf("?");
+	if (queryStart !== -1) {
+		const query = text.slice(queryStart + 1).split("#", 1)[0] ?? "";
+		for (const pair of query.split("&")) {
+			const eq = pair.indexOf("=");
+			if (eq > 0 && QUERY_NAMES.has(normalizeName(safeDecode(pair.slice(0, eq))))) out.push(pair.slice(eq + 1));
+		}
+	}
+	return out.flatMap(variantsOf);
+}
+/** Every secret string held in a config-like value: secret-keyed values, header values, URL secrets. */
+function collectSecrets(value, depth = 0, key = "") {
+	if (typeof value === "string") {
+		if (isSecretKey(key)) return [value];
+		return SCHEME_PREFIX.test(value) || isUrlKey(key) ? urlSecrets(value) : [];
+	}
+	if (!value || typeof value !== "object" || depth > MAX_DEPTH) return [];
+	if (typeof URL !== "undefined" && value instanceof URL) return urlSecrets(value);
+	if (Array.isArray(value)) return value.flatMap((v) => collectSecrets(v, depth + 1, key));
+	if (!isPlainObject(value)) return [];
+	const isHeaders = key.toLowerCase() === "headers";
+	return Object.entries(value).flatMap(([name, inner]) => {
+		if (isHeaders && typeof inner === "string") return [inner];
+		if (isSecretKey(name) && inner !== null && typeof inner === "object") return collectSecrets(inner, depth + 1, "secret");
+		return collectSecrets(inner, depth + 1, name);
+	});
+}
+/** Replaces URL userinfo and every spelling of the given secret values in `text`. */
+function scrubSecrets(text, secrets) {
+	let out = text.replace(USERINFO, `$1${REDACTED}@`);
+	const all = new Set(secrets.flatMap((s) => s && s.length >= MIN_SECRET_LENGTH ? variantsOf(s) : []));
+	for (const secret of [...all].sort((a, b) => b.length - a.length)) if (secret.length >= MIN_SECRET_LENGTH) out = out.split(secret).join(REDACTED);
+	return out;
+}
+/** Scrubs message, stack and the cause chain of `err` in place; returns it. */
+function scrubError(err, secrets, depth = 0) {
+	if (!(err instanceof Error) || depth > 3) return err;
+	try {
+		err.message = scrubSecrets(err.message, secrets);
+		if (err.stack) err.stack = scrubSecrets(err.stack, secrets);
+		scrubError(err.cause, secrets, depth + 1);
+	} catch {}
+	return err;
+}
+/** A `.catch()` handler that scrubs the secrets from the error, then rethrows it. */
+function scrubbing(secrets) {
+	return (err) => {
+		throw scrubError(err, secrets());
+	};
+}
+export { scrubbing as a, scrubSecrets as i, protectSecrets as n, urlSecrets as o, scrubError as r, collectSecrets as t };
+
+//# sourceMappingURL=secret-config-Dhb6pqTU.mjs.map

package/dist/secret-config-Dhb6pqTU.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-config-Dhb6pqTU.mjs","names":[],"sources":["../src/transports/secret-config.ts"],"sourcesContent":["/**\n * Keeps credentials out of serialized transport output and error text.\n *\n * `protectSecrets()` replaces each listed field with a non-enumerable accessor backed\n * by a WeakMap, whether or not the field is assigned yet, so later assignments (a\n * connection opened on first write, a refreshed token) stay hidden too. It also\n * installs `toJSON()` and a Node inspect hook returning a redacted view: scalar\n * fields stay for debugging, secret-looking keys become '[REDACTED]', URLs lose\n * userinfo, query and fragment. No Node imports, so browser bundles can use it.\n */\n\nimport { assignOwn } from '../utils/own-property';\nimport {\n  DEFAULT_REDACT_QUERY_PARAMS,\n  SENSITIVE_KEY_NAMES,\n  TRANSPORT_CONFIG_SECRET_NAMES,\n} from '../utils/sensitive-names';\n\nexport const REDACTED = '[REDACTED]';\n\nconst INSPECT_CUSTOM = Symbol.for('nodejs.util.inspect.custom');\nconst MAX_DEPTH = 4;\nconst MIN_SECRET_LENGTH = 4;\nconst SCHEME_PREFIX = /^[a-z][a-z0-9+.-]*:\\/\\//i;\n/** `scheme://userinfo@`: userinfo runs to the LAST `@` before the path, so `p@ss` is covered. */\nconst USERINFO = /(\\b[a-z][a-z0-9+.-]*:\\/\\/)[^\\s/?#]*@/gi;\n\nfunction normalizeName(name: string): string {\n  return name.toLowerCase().replaceAll('-', '').replaceAll('_', '');\n}\n\nconst SECRET_NAMES = [...SENSITIVE_KEY_NAMES, ...TRANSPORT_CONFIG_SECRET_NAMES].map(normalizeName);\nconst QUERY_NAMES = new Set(DEFAULT_REDACT_QUERY_PARAMS.map(normalizeName));\n\n/** Exact match for short names (`key`, `pfx`), suffix match for longer ones (`azureClientSecret`). */\nfunction isSecretKey(key: string): boolean {\n  const name = normalizeName(key);\n  return SECRET_NAMES.some((n) => name === n || (n.length >= 5 && name.endsWith(n)));\n}\n\nfunction isUrlKey(key: string): boolean {\n  return /url|uri|endpoint|href/i.test(key);\n}\n\nfunction isPlainObject(value: object): boolean {\n  const proto = Object.getPrototypeOf(value) as unknown;\n  return proto === Object.prototype || proto === null;\n}\n\nfunction safeDecode(value: string): string {\n  try {\n    return decodeURIComponent(value.replaceAll('+', ' '));\n  } catch {\n    return value;\n  }\n}\n\n/** Absolute URL: `scheme://host` only. Relative or unparseable: path kept, query and fragment cut. */\nexport function redactUrl(raw: string | URL): string {\n  if (typeof raw !== 'string') return `${raw.protocol}//${raw.host}`;\n  if (SCHEME_PREFIX.test(raw)) {\n    try {\n      const url = new URL(raw);\n      return `${url.protocol}//${url.host}`;\n    } catch {\n      return REDACTED;\n    }\n  }\n  return raw.split(/[?#]/, 1)[0] ?? '';\n}\n\nfunction redactHeaders(headers: unknown): unknown {\n  if (!headers || typeof headers !== 'object') return headers;\n  return Object.fromEntries(Object.keys(headers).map((name) => [name, REDACTED]));\n}\n\n/** Redacted deep copy of a config-like value. Never throws, never returns a secret. */\nexport function redactConfig(value: unknown, depth = 0, key = ''): unknown {\n  if (value === null || value === undefined) return value;\n  if (typeof value === 'string') {\n    return SCHEME_PREFIX.test(value) || isUrlKey(key) ? redactUrl(value) : value;\n  }\n  if (typeof value === 'number' || typeof value === 'boolean') return value;\n  if (typeof value === 'function') return '[Function]';\n  if (typeof value !== 'object') return '[Unserializable]';\n  if (typeof URL !== 'undefined' && value instanceof URL) return redactUrl(value);\n  if (Array.isArray(value)) {\n    return depth >= MAX_DEPTH ? '[Array]' : value.map((v) => redactConfig(v, depth + 1, key));\n  }\n  if (!isPlainObject(value) || depth >= MAX_DEPTH)\n    return `[${value.constructor?.name ?? 'Object'}]`;\n  const out: Record<string, unknown> = {};\n  for (const [name, inner] of Object.entries(value)) {\n    if (isSecretKey(name)) assignOwn(out, name, inner === undefined ? undefined : REDACTED);\n    else if (name.toLowerCase() === 'headers') assignOwn(out, name, redactHeaders(inner));\n    else assignOwn(out, name, redactConfig(inner, depth + 1, name));\n  }\n  return out;\n}\n\n// ── Secret protection ───────────────────────────────────────────────────────\n\nconst hiddenKeys = new WeakMap<object, Set<string>>();\nconst hiddenValues = new WeakMap<object, Map<string, unknown>>();\n\nfunction viewOf(target: object): Record<string, unknown> {\n  const hidden = hiddenKeys.get(target) ?? new Set<string>();\n  const values = hiddenValues.get(target);\n  const view: Record<string, unknown> = { class: target.constructor?.name };\n  for (const key of new Set([...Object.keys(target), ...hidden])) {\n    const inner = hidden.has(key) ? values?.get(key) : (target as Record<string, unknown>)[key];\n    if (isSecretKey(key)) view[key] = inner === undefined ? undefined : REDACTED;\n    else if (key.toLowerCase() === 'headers') view[key] = redactHeaders(inner);\n    else if (\n      inner !== null &&\n      typeof inner === 'object' &&\n      !hidden.has(key) &&\n      !(inner instanceof URL)\n    ) {\n      view[key] = '[Object]';\n    } else if (hidden.has(key) && typeof inner === 'string' && !isUrlKey(key)) {\n      view[key] = REDACTED;\n    } else view[key] = redactConfig(inner, 0, key);\n  }\n  return view;\n}\n\n/**\n * Hides `keys` on `target` (assigned or not yet) and gives it a redacted `toJSON()` /\n * inspect view. Fields stay readable and writable. Safe to call more than once.\n * Throws when the target cannot carry the protection (frozen or sealed), instead of\n * silently leaving the secret enumerable.\n */\nexport function protectSecrets(target: object, keys: readonly string[]): void {\n  if (!Object.isExtensible(target)) {\n    throw new TypeError(\n      `protectSecrets: ${target.constructor?.name ?? 'object'} is not extensible`\n    );\n  }\n  let hidden = hiddenKeys.get(target);\n  let values = hiddenValues.get(target);\n  if (!hidden || !values) {\n    hidden = new Set();\n    values = new Map();\n    hiddenKeys.set(target, hidden);\n    hiddenValues.set(target, values);\n    const view = (): Record<string, unknown> => viewOf(target);\n    Object.defineProperty(target, 'toJSON', { value: view, enumerable: false, configurable: true });\n    Object.defineProperty(target, INSPECT_CUSTOM, {\n      value: view,\n      enumerable: false,\n      configurable: true,\n    });\n  }\n  const store = values;\n  for (const key of keys) {\n    if (hidden.has(key)) continue;\n    const desc = Object.getOwnPropertyDescriptor(target, key);\n    if (desc && !desc.configurable) {\n      throw new TypeError(`protectSecrets: \"${key}\" is not configurable`);\n    }\n    if (desc && 'value' in desc) store.set(key, desc.value);\n    hidden.add(key);\n    Object.defineProperty(target, key, {\n      enumerable: false,\n      configurable: true,\n      get: () => store.get(key),\n      set: (next: unknown) => void store.set(key, next),\n    });\n  }\n}\n\n// ── Scrubbing error text ────────────────────────────────────────────────────\n\n/** The raw, decoded and percent-encoded spellings of a secret. */\nfunction variantsOf(secret: string): string[] {\n  return [secret, safeDecode(secret), encodeURIComponent(secret), encodeURI(secret)];\n}\n\n/** Secret parts of a URL string: the password and the values of sensitive query parameters. */\nexport function urlSecrets(raw: string | URL): string[] {\n  const text = typeof raw === 'string' ? raw : raw.href;\n  const out: string[] = [];\n  const userinfo = new RegExp(USERINFO.source, 'i').exec(text);\n  if (userinfo) {\n    const info = text.slice(userinfo[1]!.length, userinfo.index + userinfo[0].length - 1);\n    const colon = info.indexOf(':');\n    if (colon !== -1) out.push(info.slice(colon + 1));\n  }\n  const queryStart = text.indexOf('?');\n  if (queryStart !== -1) {\n    const query = text.slice(queryStart + 1).split('#', 1)[0] ?? '';\n    for (const pair of query.split('&')) {\n      const eq = pair.indexOf('=');\n      if (eq > 0 && QUERY_NAMES.has(normalizeName(safeDecode(pair.slice(0, eq))))) {\n        out.push(pair.slice(eq + 1));\n      }\n    }\n  }\n  return out.flatMap(variantsOf);\n}\n\n/** Every secret string held in a config-like value: secret-keyed values, header values, URL secrets. */\nexport function collectSecrets(value: unknown, depth = 0, key = ''): string[] {\n  if (typeof value === 'string') {\n    if (isSecretKey(key)) return [value];\n    return SCHEME_PREFIX.test(value) || isUrlKey(key) ? urlSecrets(value) : [];\n  }\n  if (!value || typeof value !== 'object' || depth > MAX_DEPTH) return [];\n  if (typeof URL !== 'undefined' && value instanceof URL) return urlSecrets(value);\n  if (Array.isArray(value)) return value.flatMap((v) => collectSecrets(v, depth + 1, key));\n  if (!isPlainObject(value)) return [];\n  const isHeaders = key.toLowerCase() === 'headers';\n  return Object.entries(value).flatMap(([name, inner]) => {\n    if (isHeaders && typeof inner === 'string') return [inner];\n    if (isSecretKey(name) && inner !== null && typeof inner === 'object') {\n      return collectSecrets(inner, depth + 1, 'secret');\n    }\n    return collectSecrets(inner, depth + 1, name);\n  });\n}\n\n/** Replaces URL userinfo and every spelling of the given secret values in `text`. */\nexport function scrubSecrets(text: string, secrets: readonly (string | undefined)[]): string {\n  let out = text.replace(USERINFO, `$1${REDACTED}@`);\n  const all = new Set(\n    secrets.flatMap((s) => (s && s.length >= MIN_SECRET_LENGTH ? variantsOf(s) : []))\n  );\n  for (const secret of [...all].sort((a, b) => b.length - a.length)) {\n    if (secret.length >= MIN_SECRET_LENGTH) out = out.split(secret).join(REDACTED);\n  }\n  return out;\n}\n\n/** Scrubs message, stack and the cause chain of `err` in place; returns it. */\nexport function scrubError<T>(err: T, secrets: readonly (string | undefined)[], depth = 0): T {\n  if (!(err instanceof Error) || depth > 3) return err;\n  try {\n    err.message = scrubSecrets(err.message, secrets);\n    if (err.stack) err.stack = scrubSecrets(err.stack, secrets);\n    scrubError((err as { cause?: unknown }).cause, secrets, depth + 1);\n  } catch {\n    /* frozen error: leave as is */\n  }\n  return err;\n}\n\n/** A `.catch()` handler that scrubs the secrets from the error, then rethrows it. */\nexport function scrubbing(secrets: () => (string | undefined)[]): (err: unknown) => never {\n  return (err) => {\n    throw scrubError(err, secrets());\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AAkBA,MAAa,WAAW;AAExB,MAAM,iBAAiB,OAAO,IAAI,4BAA4B;AAC9D,MAAM,YAAY;AAClB,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;;AAEtB,MAAM,WAAW;AAEjB,SAAS,cAAc,MAAsB;CAC3C,OAAO,KAAK,YAAY,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,WAAW,KAAK,EAAE;AAClE;AAEA,MAAM,eAAe,CAAC,GAAG,qBAAqB,GAAG,6BAA6B,CAAC,CAAC,IAAI,aAAa;AACjG,MAAM,cAAc,IAAI,IAAI,4BAA4B,IAAI,aAAa,CAAC;;AAG1E,SAAS,YAAY,KAAsB;CACzC,MAAM,OAAO,cAAc,GAAG;CAC9B,OAAO,aAAa,MAAM,MAAM,SAAS,KAAM,EAAE,UAAU,KAAK,KAAK,SAAS,CAAC,CAAE;AACnF;AAEA,SAAS,SAAS,KAAsB;CACtC,OAAO,yBAAyB,KAAK,GAAG;AAC1C;AAEA,SAAS,cAAc,OAAwB;CAC7C,MAAM,QAAQ,OAAO,eAAe,KAAK;CACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,SAAS,WAAW,OAAuB;CACzC,IAAI;EACF,OAAO,mBAAmB,MAAM,WAAW,KAAK,GAAG,CAAC;CACtD,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,UAAU,KAA2B;CACnD,IAAI,OAAO,QAAQ,UAAU,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CAC5D,IAAI,cAAc,KAAK,GAAG,GACxB,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,GAAG;EACvB,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN,OAAO;CACT;CAEF,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,MAAM;AACpC;AAEA,SAAS,cAAc,SAA2B;CAChD,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU,OAAO;CACpD,OAAO,OAAO,YAAY,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,QAAQ,CAAC,CAAC;AAChF;;AAGA,SAAgB,aAAa,OAAgB,QAAQ,GAAG,MAAM,IAAa;;CACzE,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,OAAO;CAClD,IAAI,OAAO,UAAU,UACnB,OAAO,cAAc,KAAK,KAAK,KAAK,SAAS,GAAG,IAAI,UAAU,KAAK,IAAI;CAEzE,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW,OAAO;CACpE,IAAI,OAAO,UAAU,YAAY,OAAO;CACxC,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,OAAO,QAAQ,eAAe,iBAAiB,KAAK,OAAO,UAAU,KAAK;CAC9E,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,SAAS,YAAY,YAAY,MAAM,KAAK,MAAM,aAAa,GAAG,QAAQ,GAAG,GAAG,CAAC;CAE1F,IAAI,CAAC,cAAc,KAAK,KAAK,SAAS,WACpC,OAAO,MAAA,qBAAI,MAAM,iBAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAa,SAAQ,SAAS;CACjD,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,GAC9C,IAAI,YAAY,IAAI,GAAG,UAAU,KAAK,MAAM,UAAU,KAAA,IAAY,KAAA,IAAY,QAAQ;MACjF,IAAI,KAAK,YAAY,MAAM,WAAW,UAAU,KAAK,MAAM,cAAc,KAAK,CAAC;MAC/E,UAAU,KAAK,MAAM,aAAa,OAAO,QAAQ,GAAG,IAAI,CAAC;CAEhE,OAAO;AACT;AAIA,MAAM,6BAAa,IAAI,QAA6B;AACpD,MAAM,+BAAe,IAAI,QAAsC;AAE/D,SAAS,OAAO,QAAyC;;CACvD,MAAM,SAAS,WAAW,IAAI,MAAM,qBAAK,IAAI,IAAY;CACzD,MAAM,SAAS,aAAa,IAAI,MAAM;CACtC,MAAM,OAAgC,EAAE,QAAA,sBAAO,OAAO,iBAAA,QAAA,wBAAA,KAAA,IAAA,KAAA,IAAA,oBAAa,KAAK;CACxE,KAAK,MAAM,uBAAO,IAAI,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;EAC9D,MAAM,QAAQ,OAAO,IAAI,GAAG,IAAA,WAAA,QAAA,WAAA,KAAA,IAAA,KAAA,IAAI,OAAQ,IAAI,GAAG,IAAK,OAAmC;EACvF,IAAI,YAAY,GAAG,GAAG,KAAK,OAAO,UAAU,KAAA,IAAY,KAAA,IAAY;OAC/D,IAAI,IAAI,YAAY,MAAM,WAAW,KAAK,OAAO,cAAc,KAAK;OACpE,IACH,UAAU,QACV,OAAO,UAAU,YACjB,CAAC,OAAO,IAAI,GAAG,KACf,EAAE,iBAAiB,MAEnB,KAAK,OAAO;OACP,IAAI,OAAO,IAAI,GAAG,KAAK,OAAO,UAAU,YAAY,CAAC,SAAS,GAAG,GACtE,KAAK,OAAO;OACP,KAAK,OAAO,aAAa,OAAO,GAAG,GAAG;CAC/C;CACA,OAAO;AACT;;;;;;;AAQA,SAAgB,eAAe,QAAgB,MAA+B;CAC5E,IAAI,CAAC,OAAO,aAAa,MAAM,GAAG;;EAChC,MAAM,IAAI,UACR,qBAAA,uBAAmB,OAAO,iBAAA,QAAA,yBAAA,KAAA,IAAA,KAAA,IAAA,qBAAa,SAAQ,SAAS,mBAC1D;CACF;CACA,IAAI,SAAS,WAAW,IAAI,MAAM;CAClC,IAAI,SAAS,aAAa,IAAI,MAAM;CACpC,IAAI,CAAC,UAAU,CAAC,QAAQ;EACtB,yBAAS,IAAI,IAAI;EACjB,yBAAS,IAAI,IAAI;EACjB,WAAW,IAAI,QAAQ,MAAM;EAC7B,aAAa,IAAI,QAAQ,MAAM;EAC/B,MAAM,aAAsC,OAAO,MAAM;EACzD,OAAO,eAAe,QAAQ,UAAU;GAAE,OAAO;GAAM,YAAY;GAAO,cAAc;EAAK,CAAC;EAC9F,OAAO,eAAe,QAAQ,gBAAgB;GAC5C,OAAO;GACP,YAAY;GACZ,cAAc;EAChB,CAAC;CACH;CACA,MAAM,QAAQ;CACd,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,OAAO,IAAI,GAAG,GAAG;EACrB,MAAM,OAAO,OAAO,yBAAyB,QAAQ,GAAG;EACxD,IAAI,QAAQ,CAAC,KAAK,cAChB,MAAM,IAAI,UAAU,oBAAoB,IAAI,sBAAsB;EAEpE,IAAI,QAAQ,WAAW,MAAM,MAAM,IAAI,KAAK,KAAK,KAAK;EACtD,OAAO,IAAI,GAAG;EACd,OAAO,eAAe,QAAQ,KAAK;GACjC,YAAY;GACZ,cAAc;GACd,WAAW,MAAM,IAAI,GAAG;GACxB,MAAM,SAAkB,KAAK,MAAM,IAAI,KAAK,IAAI;EAClD,CAAC;CACH;AACF;;AAKA,SAAS,WAAW,QAA0B;CAC5C,OAAO;EAAC;EAAQ,WAAW,MAAM;EAAG,mBAAmB,MAAM;EAAG,UAAU,MAAM;CAAC;AACnF;;AAGA,SAAgB,WAAW,KAA6B;CACtD,MAAM,OAAO,OAAO,QAAQ,WAAW,MAAM,IAAI;CACjD,MAAM,MAAgB,CAAC;CACvB,MAAM,WAAW,IAAI,OAAO,SAAS,QAAQ,GAAG,CAAC,CAAC,KAAK,IAAI;CAC3D,IAAI,UAAU;EACZ,MAAM,OAAO,KAAK,MAAM,SAAS,EAAE,CAAE,QAAQ,SAAS,QAAQ,SAAS,EAAE,CAAC,SAAS,CAAC;EACpF,MAAM,QAAQ,KAAK,QAAQ,GAAG;EAC9B,IAAI,UAAU,IAAI,IAAI,KAAK,KAAK,MAAM,QAAQ,CAAC,CAAC;CAClD;CACA,MAAM,aAAa,KAAK,QAAQ,GAAG;CACnC,IAAI,eAAe,IAAI;EACrB,MAAM,QAAQ,KAAK,MAAM,aAAa,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM;EAC7D,KAAK,MAAM,QAAQ,MAAM,MAAM,GAAG,GAAG;GACnC,MAAM,KAAK,KAAK,QAAQ,GAAG;GAC3B,IAAI,KAAK,KAAK,YAAY,IAAI,cAAc,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GACxE,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC;EAE/B;CACF;CACA,OAAO,IAAI,QAAQ,UAAU;AAC/B;;AAGA,SAAgB,eAAe,OAAgB,QAAQ,GAAG,MAAM,IAAc;CAC5E,IAAI,OAAO,UAAU,UAAU;EAC7B,IAAI,YAAY,GAAG,GAAG,OAAO,CAAC,KAAK;EACnC,OAAO,cAAc,KAAK,KAAK,KAAK,SAAS,GAAG,IAAI,WAAW,KAAK,IAAI,CAAC;CAC3E;CACA,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,QAAQ,WAAW,OAAO,CAAC;CACtE,IAAI,OAAO,QAAQ,eAAe,iBAAiB,KAAK,OAAO,WAAW,KAAK;CAC/E,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,SAAS,MAAM,eAAe,GAAG,QAAQ,GAAG,GAAG,CAAC;CACvF,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,CAAC;CACnC,MAAM,YAAY,IAAI,YAAY,MAAM;CACxC,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,WAAW;EACtD,IAAI,aAAa,OAAO,UAAU,UAAU,OAAO,CAAC,KAAK;EACzD,IAAI,YAAY,IAAI,KAAK,UAAU,QAAQ,OAAO,UAAU,UAC1D,OAAO,eAAe,OAAO,QAAQ,GAAG,QAAQ;EAElD,OAAO,eAAe,OAAO,QAAQ,GAAG,IAAI;CAC9C,CAAC;AACH;;AAGA,SAAgB,aAAa,MAAc,SAAkD;CAC3F,IAAI,MAAM,KAAK,QAAQ,UAAU,KAAK,SAAS,EAAE;CACjD,MAAM,MAAM,IAAI,IACd,QAAQ,SAAS,MAAO,KAAK,EAAE,UAAU,oBAAoB,WAAW,CAAC,IAAI,CAAC,CAAE,CAClF;CACA,KAAK,MAAM,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAC9D,IAAI,OAAO,UAAU,mBAAmB,MAAM,IAAI,MAAM,MAAM,CAAC,CAAC,KAAK,QAAQ;CAE/E,OAAO;AACT;;AAGA,SAAgB,WAAc,KAAQ,SAA0C,QAAQ,GAAM;CAC5F,IAAI,EAAE,eAAe,UAAU,QAAQ,GAAG,OAAO;CACjD,IAAI;EACF,IAAI,UAAU,aAAa,IAAI,SAAS,OAAO;EAC/C,IAAI,IAAI,OAAO,IAAI,QAAQ,aAAa,IAAI,OAAO,OAAO;EAC1D,WAAY,IAA4B,OAAO,SAAS,QAAQ,CAAC;CACnE,QAAQ,CAER;CACA,OAAO;AACT;;AAGA,SAAgB,UAAU,SAAgE;CACxF,QAAQ,QAAQ;EACd,MAAM,WAAW,KAAK,QAAQ,CAAC;CACjC;AACF"}

package/dist/{slack.transport-CXjQYOes.d.ts → slack.transport-BDyENuR0.d.mts}

@@ -1,7 +1,57 @@
-import { p as TransportLogEntry, s as IAsyncTransport } from "./transport.types-CGoHpWQR.js";
-
-//#region src/transports/discord.transport.d.ts
-
+import { _ as TransportLogEntry, l as IAsyncTransport } from "./transport.types-CzJq4IrF.mjs";
+interface OtlpLogTransportConfig {
+  /** OTLP/HTTP logs endpoint, e.g. `http://localhost:4318/v1/logs`. */
+  url: string;
+  /** Extra HTTP headers (auth, tenant, etc.). */
+  headers?: Record<string, string>;
+  /** `service.name` resource attribute. Default: 'logixia'. */
+  serviceName?: string;
+  /** `service.version` resource attribute. */
+  serviceVersion?: string;
+  /** `deployment.environment` resource attribute. */
+  environment?: string;
+  /** Extra resource attributes merged into the OTLP resource. */
+  resourceAttributes?: Record<string, string | number | boolean>;
+  /** Entries per batch / per POST. Default: 100. */
+  batchSize?: number;
+  /** Auto-flush interval (ms). Default: 5000. */
+  flushIntervalMs?: number;
+  /** Abort a request that has not finished after this many ms. Default: 10000. */
+  requestTimeoutMs?: number;
+  /** Max buffered entries; the oldest are dropped past this. Default: 10000. */
+  maxBufferSize?: number;
+  level?: string;
+}
+/**
+ * Map a logixia level name to an OTel SeverityNumber (1–24) and text.
+ * Per the OTel logs SDK spec: TRACE=1, DEBUG=5, INFO=9, WARN=13, ERROR=17,
+ * FATAL=21. Custom/unknown levels fall back to INFO (9).
+ */
+declare function toOtelSeverity(level: string): {
+  number: number;
+  text: string;
+};
+declare class OtlpLogTransport implements IAsyncTransport {
+  readonly name = "otlp";
+  readonly level: string | undefined;
+  private readonly url;
+  private readonly headers;
+  private readonly batchSize;
+  private readonly flushIntervalMs;
+  private readonly requestTimeoutMs;
+  private readonly resourceAttrs;
+  private readonly buffer;
+  private flushTimer;
+  constructor(config: OtlpLogTransportConfig);
+  write(entry: TransportLogEntry): void;
+  /** Convert one entry into an OTLP LogRecord. */
+  private toLogRecord;
+  private buildPayload;
+  flush(): Promise<void>;
+  private secretValues;
+  private send;
+  close(): Promise<void>;
+}
 interface DiscordEmbedField {
   name: string;
   value: string;
@@ -58,8 +108,6 @@ declare class DiscordTransport implements IAsyncTransport {
   private fitToBudget;
   private draftFor;
 }
-//#endregion
-//#region src/transports/slack.transport.d.ts
 /** A Slack message body as returned by a custom `formatter`. */
 interface SlackMessage {
   text?: string;
@@ -107,6 +155,5 @@ declare class SlackTransport implements IAsyncTransport {
   private buildPayload;
   private messageFor;
 }
-//#endregion
-export { DiscordTransport as a, DiscordEmbed as i, SlackTransport as n, DiscordTransportConfig as o, SlackTransportConfig as r, SlackMessage as t };
-//# sourceMappingURL=slack.transport-CXjQYOes.d.ts.map
+export { DiscordTransport as a, OtlpLogTransportConfig as c, DiscordEmbed as i, toOtelSeverity as l, SlackTransport as n, DiscordTransportConfig as o, SlackTransportConfig as r, OtlpLogTransport as s, SlackMessage as t };
+//# sourceMappingURL=slack.transport-BDyENuR0.d.mts.map

package/dist/slack.transport-BDyENuR0.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.transport-BDyENuR0.d.mts","names":[],"sources":["../src/transports/otlp.transport.ts","../src/transports/discord.transport.ts","../src/transports/slack.transport.ts"],"mappings":";UAuCiB;;EAEf;;EAEA,UAAU;;EAEV;;EAEA;;EAEA;;EAEA,qBAAqB;;EAErB;;EAEA;;EAEA;;EAEA;EACA;;;;;;;iBA0Bc,eAAe;EAAkB;EAAgB;;cA4GpD,4BAA4B;WACvB;WACA;mBAEC;mBACA;mBACA;mBACA;mBACA;mBACA;mBAEA;UACT;EAEI,YAAA,QAAQ;EA+BpB,MAAM,OAAO;;UAML;UA+BA;EAgBR,SAAS;UAID;UAIM;EA4BR,SAAS;;UC1RA;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA;EACA,SAAS;GACR;;UAGc;;EAEf;;EAEA;EACA;;EAEA;;EAEA;;;;;EAKA,aAAa,OAAO,sBAAsB;EAC1C,UAAU,OAAO;;EAEjB;;EAEA;;EAEA;EACA;;cA0FW,4BAA4B;WACvB;WACA;EACT,UAAU,OAAO;mBAEP;mBACA;mBACA;mBACA;EAEL,YAAA,QAAQ;EAiCpB,MAAM,OAAO;EAMb,SAAS;EAIT,SAAS;;EAKT,UAAU;UASF;;UAoBA;UAgBA;;;UC9OO;EACf;EACA;GACC;;UAGc;;EAEf;;EAEA;EACA;EACA;;EAEA;;;;;;EAMA,aAAa,OAAO,sBAAsB;EAC1C,UAAU,OAAO;;EAEjB;;EAEA;;EAEA;EACA;;cAgBW,0BAA0B;WACrB;WACA;EACT,UAAU,OAAO;mBAEP;mBACA;mBACA;mBACA;EAEL,YAAA,QAAQ;EA4BpB,MAAM,OAAO;EAMb,SAAS;EAIT,SAAS;;EAKT,UAAU;UASF;UAiBA"}