logixia 2.0.10 → 2.1.0

package/dist/{secret-config-BvFl2dC8.js → secret-config--cVTOWwp.js}

@@ -19,7 +19,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	value: mod,
 	enumerable: true
 }) : target, mod));
-const require_sensitive_names = require("./sensitive-names-CHMowujD.js");
+const require_own_property = require("./own-property-BWkibepN.js");
+const require_sensitive_names = require("./sensitive-names-NiKIRhp5.js");
 // src/transports/secret-config.ts
 /**
 * Keeps credentials out of serialized transport output and error text.
@@ -89,9 +90,9 @@ function redactConfig(value, depth = 0, key = "") {
 	if (Array.isArray(value)) return depth >= MAX_DEPTH ? "[Array]" : value.map((v) => redactConfig(v, depth + 1, key));
 	if (!isPlainObject(value) || depth >= MAX_DEPTH) return `[${((_value$constructor = value.constructor) === null || _value$constructor === void 0 ? void 0 : _value$constructor.name) ?? "Object"}]`;
 	const out = {};
-	for (const [name, inner] of Object.entries(value)) if (isSecretKey(name)) require_sensitive_names.assignOwn(out, name, inner === void 0 ? void 0 : REDACTED);
-	else if (name.toLowerCase() === "headers") require_sensitive_names.assignOwn(out, name, redactHeaders(inner));
-	else require_sensitive_names.assignOwn(out, name, redactConfig(inner, depth + 1, name));
+	for (const [name, inner] of Object.entries(value)) if (isSecretKey(name)) require_own_property.assignOwn(out, name, inner === void 0 ? void 0 : REDACTED);
+	else if (name.toLowerCase() === "headers") require_own_property.assignOwn(out, name, redactHeaders(inner));
+	else require_own_property.assignOwn(out, name, redactConfig(inner, depth + 1, name));
 	return out;
 }
 const hiddenKeys = /* @__PURE__ */ new WeakMap();
@@ -268,4 +269,4 @@ Object.defineProperty(exports, "urlSecrets", {
 	}
 });
 
-//# sourceMappingURL=secret-config-BvFl2dC8.js.map
+//# sourceMappingURL=secret-config--cVTOWwp.js.map

package/dist/{secret-config-BvFl2dC8.js.map → secret-config--cVTOWwp.js.map}

@@ -1 +1 @@
-{"version":3,"file":"secret-config-BvFl2dC8.js","names":["SENSITIVE_KEY_NAMES","TRANSPORT_CONFIG_SECRET_NAMES","DEFAULT_REDACT_QUERY_PARAMS"],"sources":["../src/transports/secret-config.ts"],"sourcesContent":["/**\n * Keeps credentials out of serialized transport output and error text.\n *\n * `protectSecrets()` replaces each listed field with a non-enumerable accessor backed\n * by a WeakMap, whether or not the field is assigned yet, so later assignments (a\n * connection opened on first write, a refreshed token) stay hidden too. It also\n * installs `toJSON()` and a Node inspect hook returning a redacted view: scalar\n * fields stay for debugging, secret-looking keys become '[REDACTED]', URLs lose\n * userinfo, query and fragment. No Node imports, so browser bundles can use it.\n */\n\nimport { assignOwn } from '../utils/own-property';\nimport {\n  DEFAULT_REDACT_QUERY_PARAMS,\n  SENSITIVE_KEY_NAMES,\n  TRANSPORT_CONFIG_SECRET_NAMES,\n} from '../utils/sensitive-names';\n\nexport const REDACTED = '[REDACTED]';\n\nconst INSPECT_CUSTOM = Symbol.for('nodejs.util.inspect.custom');\nconst MAX_DEPTH = 4;\nconst MIN_SECRET_LENGTH = 4;\nconst SCHEME_PREFIX = /^[a-z][a-z0-9+.-]*:\\/\\//i;\n/** `scheme://userinfo@`: userinfo runs to the LAST `@` before the path, so `p@ss` is covered. */\nconst USERINFO = /(\\b[a-z][a-z0-9+.-]*:\\/\\/)[^\\s/?#]*@/gi;\n\nfunction normalizeName(name: string): string {\n  return name.toLowerCase().replaceAll('-', '').replaceAll('_', '');\n}\n\nconst SECRET_NAMES = [...SENSITIVE_KEY_NAMES, ...TRANSPORT_CONFIG_SECRET_NAMES].map(normalizeName);\nconst QUERY_NAMES = new Set(DEFAULT_REDACT_QUERY_PARAMS.map(normalizeName));\n\n/** Exact match for short names (`key`, `pfx`), suffix match for longer ones (`azureClientSecret`). */\nfunction isSecretKey(key: string): boolean {\n  const name = normalizeName(key);\n  return SECRET_NAMES.some((n) => name === n || (n.length >= 5 && name.endsWith(n)));\n}\n\nfunction isUrlKey(key: string): boolean {\n  return /url|uri|endpoint|href/i.test(key);\n}\n\nfunction isPlainObject(value: object): boolean {\n  const proto = Object.getPrototypeOf(value) as unknown;\n  return proto === Object.prototype || proto === null;\n}\n\nfunction safeDecode(value: string): string {\n  try {\n    return decodeURIComponent(value.replaceAll('+', ' '));\n  } catch {\n    return value;\n  }\n}\n\n/** Absolute URL: `scheme://host` only. Relative or unparseable: path kept, query and fragment cut. */\nexport function redactUrl(raw: string | URL): string {\n  if (typeof raw !== 'string') return `${raw.protocol}//${raw.host}`;\n  if (SCHEME_PREFIX.test(raw)) {\n    try {\n      const url = new URL(raw);\n      return `${url.protocol}//${url.host}`;\n    } catch {\n      return REDACTED;\n    }\n  }\n  return raw.split(/[?#]/, 1)[0] ?? '';\n}\n\nfunction redactHeaders(headers: unknown): unknown {\n  if (!headers || typeof headers !== 'object') return headers;\n  return Object.fromEntries(Object.keys(headers).map((name) => [name, REDACTED]));\n}\n\n/** Redacted deep copy of a config-like value. Never throws, never returns a secret. */\nexport function redactConfig(value: unknown, depth = 0, key = ''): unknown {\n  if (value === null || value === undefined) return value;\n  if (typeof value === 'string') {\n    return SCHEME_PREFIX.test(value) || isUrlKey(key) ? redactUrl(value) : value;\n  }\n  if (typeof value === 'number' || typeof value === 'boolean') return value;\n  if (typeof value === 'function') return '[Function]';\n  if (typeof value !== 'object') return '[Unserializable]';\n  if (typeof URL !== 'undefined' && value instanceof URL) return redactUrl(value);\n  if (Array.isArray(value)) {\n    return depth >= MAX_DEPTH ? '[Array]' : value.map((v) => redactConfig(v, depth + 1, key));\n  }\n  if (!isPlainObject(value) || depth >= MAX_DEPTH)\n    return `[${value.constructor?.name ?? 'Object'}]`;\n  const out: Record<string, unknown> = {};\n  for (const [name, inner] of Object.entries(value)) {\n    if (isSecretKey(name)) assignOwn(out, name, inner === undefined ? undefined : REDACTED);\n    else if (name.toLowerCase() === 'headers') assignOwn(out, name, redactHeaders(inner));\n    else assignOwn(out, name, redactConfig(inner, depth + 1, name));\n  }\n  return out;\n}\n\n// ── Secret protection ───────────────────────────────────────────────────────\n\nconst hiddenKeys = new WeakMap<object, Set<string>>();\nconst hiddenValues = new WeakMap<object, Map<string, unknown>>();\n\nfunction viewOf(target: object): Record<string, unknown> {\n  const hidden = hiddenKeys.get(target) ?? new Set<string>();\n  const values = hiddenValues.get(target);\n  const view: Record<string, unknown> = { class: target.constructor?.name };\n  for (const key of new Set([...Object.keys(target), ...hidden])) {\n    const inner = hidden.has(key) ? values?.get(key) : (target as Record<string, unknown>)[key];\n    if (isSecretKey(key)) view[key] = inner === undefined ? undefined : REDACTED;\n    else if (key.toLowerCase() === 'headers') view[key] = redactHeaders(inner);\n    else if (\n      inner !== null &&\n      typeof inner === 'object' &&\n      !hidden.has(key) &&\n      !(inner instanceof URL)\n    ) {\n      view[key] = '[Object]';\n    } else if (hidden.has(key) && typeof inner === 'string' && !isUrlKey(key)) {\n      view[key] = REDACTED;\n    } else view[key] = redactConfig(inner, 0, key);\n  }\n  return view;\n}\n\n/**\n * Hides `keys` on `target` (assigned or not yet) and gives it a redacted `toJSON()` /\n * inspect view. Fields stay readable and writable. Safe to call more than once.\n * Throws when the target cannot carry the protection (frozen or sealed), instead of\n * silently leaving the secret enumerable.\n */\nexport function protectSecrets(target: object, keys: readonly string[]): void {\n  if (!Object.isExtensible(target)) {\n    throw new TypeError(\n      `protectSecrets: ${target.constructor?.name ?? 'object'} is not extensible`\n    );\n  }\n  let hidden = hiddenKeys.get(target);\n  let values = hiddenValues.get(target);\n  if (!hidden || !values) {\n    hidden = new Set();\n    values = new Map();\n    hiddenKeys.set(target, hidden);\n    hiddenValues.set(target, values);\n    const view = (): Record<string, unknown> => viewOf(target);\n    Object.defineProperty(target, 'toJSON', { value: view, enumerable: false, configurable: true });\n    Object.defineProperty(target, INSPECT_CUSTOM, {\n      value: view,\n      enumerable: false,\n      configurable: true,\n    });\n  }\n  const store = values;\n  for (const key of keys) {\n    if (hidden.has(key)) continue;\n    const desc = Object.getOwnPropertyDescriptor(target, key);\n    if (desc && !desc.configurable) {\n      throw new TypeError(`protectSecrets: \"${key}\" is not configurable`);\n    }\n    if (desc && 'value' in desc) store.set(key, desc.value);\n    hidden.add(key);\n    Object.defineProperty(target, key, {\n      enumerable: false,\n      configurable: true,\n      get: () => store.get(key),\n      set: (next: unknown) => void store.set(key, next),\n    });\n  }\n}\n\n// ── Scrubbing error text ────────────────────────────────────────────────────\n\n/** The raw, decoded and percent-encoded spellings of a secret. */\nfunction variantsOf(secret: string): string[] {\n  return [secret, safeDecode(secret), encodeURIComponent(secret), encodeURI(secret)];\n}\n\n/** Secret parts of a URL string: the password and the values of sensitive query parameters. */\nexport function urlSecrets(raw: string | URL): string[] {\n  const text = typeof raw === 'string' ? raw : raw.href;\n  const out: string[] = [];\n  const userinfo = new RegExp(USERINFO.source, 'i').exec(text);\n  if (userinfo) {\n    const info = text.slice(userinfo[1]!.length, userinfo.index + userinfo[0].length - 1);\n    const colon = info.indexOf(':');\n    if (colon !== -1) out.push(info.slice(colon + 1));\n  }\n  const queryStart = text.indexOf('?');\n  if (queryStart !== -1) {\n    const query = text.slice(queryStart + 1).split('#', 1)[0] ?? '';\n    for (const pair of query.split('&')) {\n      const eq = pair.indexOf('=');\n      if (eq > 0 && QUERY_NAMES.has(normalizeName(safeDecode(pair.slice(0, eq))))) {\n        out.push(pair.slice(eq + 1));\n      }\n    }\n  }\n  return out.flatMap(variantsOf);\n}\n\n/** Every secret string held in a config-like value: secret-keyed values, header values, URL secrets. */\nexport function collectSecrets(value: unknown, depth = 0, key = ''): string[] {\n  if (typeof value === 'string') {\n    if (isSecretKey(key)) return [value];\n    return SCHEME_PREFIX.test(value) || isUrlKey(key) ? urlSecrets(value) : [];\n  }\n  if (!value || typeof value !== 'object' || depth > MAX_DEPTH) return [];\n  if (typeof URL !== 'undefined' && value instanceof URL) return urlSecrets(value);\n  if (Array.isArray(value)) return value.flatMap((v) => collectSecrets(v, depth + 1, key));\n  if (!isPlainObject(value)) return [];\n  const isHeaders = key.toLowerCase() === 'headers';\n  return Object.entries(value).flatMap(([name, inner]) => {\n    if (isHeaders && typeof inner === 'string') return [inner];\n    if (isSecretKey(name) && inner !== null && typeof inner === 'object') {\n      return collectSecrets(inner, depth + 1, 'secret');\n    }\n    return collectSecrets(inner, depth + 1, name);\n  });\n}\n\n/** Replaces URL userinfo and every spelling of the given secret values in `text`. */\nexport function scrubSecrets(text: string, secrets: readonly (string | undefined)[]): string {\n  let out = text.replace(USERINFO, `$1${REDACTED}@`);\n  const all = new Set(\n    secrets.flatMap((s) => (s && s.length >= MIN_SECRET_LENGTH ? variantsOf(s) : []))\n  );\n  for (const secret of [...all].sort((a, b) => b.length - a.length)) {\n    if (secret.length >= MIN_SECRET_LENGTH) out = out.split(secret).join(REDACTED);\n  }\n  return out;\n}\n\n/** Scrubs message, stack and the cause chain of `err` in place; returns it. */\nexport function scrubError<T>(err: T, secrets: readonly (string | undefined)[], depth = 0): T {\n  if (!(err instanceof Error) || depth > 3) return err;\n  try {\n    err.message = scrubSecrets(err.message, secrets);\n    if (err.stack) err.stack = scrubSecrets(err.stack, secrets);\n    scrubError((err as { cause?: unknown }).cause, secrets, depth + 1);\n  } catch {\n    /* frozen error: leave as is */\n  }\n  return err;\n}\n\n/** A `.catch()` handler that scrubs the secrets from the error, then rethrows it. */\nexport function scrubbing(secrets: () => (string | undefined)[]): (err: unknown) => never {\n  return (err) => {\n    throw scrubError(err, secrets());\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,MAAa,WAAW;AAExB,MAAM,iBAAiB,OAAO,IAAI,4BAA4B;AAC9D,MAAM,YAAY;AAClB,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;;AAEtB,MAAM,WAAW;AAEjB,SAAS,cAAc,MAAsB;CAC3C,OAAO,KAAK,YAAY,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,WAAW,KAAK,EAAE;AAClE;AAEA,MAAM,eAAe,CAAC,GAAGA,wBAAAA,qBAAqB,GAAGC,wBAAAA,6BAA6B,CAAC,CAAC,IAAI,aAAa;AACjG,MAAM,cAAc,IAAI,IAAIC,wBAAAA,4BAA4B,IAAI,aAAa,CAAC;;AAG1E,SAAS,YAAY,KAAsB;CACzC,MAAM,OAAO,cAAc,GAAG;CAC9B,OAAO,aAAa,MAAM,MAAM,SAAS,KAAM,EAAE,UAAU,KAAK,KAAK,SAAS,CAAC,CAAE;AACnF;AAEA,SAAS,SAAS,KAAsB;CACtC,OAAO,yBAAyB,KAAK,GAAG;AAC1C;AAEA,SAAS,cAAc,OAAwB;CAC7C,MAAM,QAAQ,OAAO,eAAe,KAAK;CACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,SAAS,WAAW,OAAuB;CACzC,IAAI;EACF,OAAO,mBAAmB,MAAM,WAAW,KAAK,GAAG,CAAC;CACtD,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,UAAU,KAA2B;CACnD,IAAI,OAAO,QAAQ,UAAU,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CAC5D,IAAI,cAAc,KAAK,GAAG,GACxB,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,GAAG;EACvB,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN,OAAO;CACT;CAEF,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,MAAM;AACpC;AAEA,SAAS,cAAc,SAA2B;CAChD,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU,OAAO;CACpD,OAAO,OAAO,YAAY,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,QAAQ,CAAC,CAAC;AAChF;;AAGA,SAAgB,aAAa,OAAgB,QAAQ,GAAG,MAAM,IAAa;;CACzE,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,OAAO;CAClD,IAAI,OAAO,UAAU,UACnB,OAAO,cAAc,KAAK,KAAK,KAAK,SAAS,GAAG,IAAI,UAAU,KAAK,IAAI;CAEzE,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW,OAAO;CACpE,IAAI,OAAO,UAAU,YAAY,OAAO;CACxC,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,OAAO,QAAQ,eAAe,iBAAiB,KAAK,OAAO,UAAU,KAAK;CAC9E,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,SAAS,YAAY,YAAY,MAAM,KAAK,MAAM,aAAa,GAAG,QAAQ,GAAG,GAAG,CAAC;CAE1F,IAAI,CAAC,cAAc,KAAK,KAAK,SAAS,WACpC,OAAO,MAAA,qBAAI,MAAM,iBAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAa,SAAQ,SAAS;CACjD,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,GAC9C,IAAI,YAAY,IAAI,GAAG,wBAAA,UAAU,KAAK,MAAM,UAAU,KAAA,IAAY,KAAA,IAAY,QAAQ;MACjF,IAAI,KAAK,YAAY,MAAM,WAAW,wBAAA,UAAU,KAAK,MAAM,cAAc,KAAK,CAAC;MAC/E,wBAAA,UAAU,KAAK,MAAM,aAAa,OAAO,QAAQ,GAAG,IAAI,CAAC;CAEhE,OAAO;AACT;AAIA,MAAM,6BAAa,IAAI,QAA6B;AACpD,MAAM,+BAAe,IAAI,QAAsC;AAE/D,SAAS,OAAO,QAAyC;;CACvD,MAAM,SAAS,WAAW,IAAI,MAAM,qBAAK,IAAI,IAAY;CACzD,MAAM,SAAS,aAAa,IAAI,MAAM;CACtC,MAAM,OAAgC,EAAE,QAAA,sBAAO,OAAO,iBAAA,QAAA,wBAAA,KAAA,IAAA,KAAA,IAAA,oBAAa,KAAK;CACxE,KAAK,MAAM,uBAAO,IAAI,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;EAC9D,MAAM,QAAQ,OAAO,IAAI,GAAG,IAAA,WAAA,QAAA,WAAA,KAAA,IAAA,KAAA,IAAI,OAAQ,IAAI,GAAG,IAAK,OAAmC;EACvF,IAAI,YAAY,GAAG,GAAG,KAAK,OAAO,UAAU,KAAA,IAAY,KAAA,IAAY;OAC/D,IAAI,IAAI,YAAY,MAAM,WAAW,KAAK,OAAO,cAAc,KAAK;OACpE,IACH,UAAU,QACV,OAAO,UAAU,YACjB,CAAC,OAAO,IAAI,GAAG,KACf,EAAE,iBAAiB,MAEnB,KAAK,OAAO;OACP,IAAI,OAAO,IAAI,GAAG,KAAK,OAAO,UAAU,YAAY,CAAC,SAAS,GAAG,GACtE,KAAK,OAAO;OACP,KAAK,OAAO,aAAa,OAAO,GAAG,GAAG;CAC/C;CACA,OAAO;AACT;;;;;;;AAQA,SAAgB,eAAe,QAAgB,MAA+B;CAC5E,IAAI,CAAC,OAAO,aAAa,MAAM,GAAG;;EAChC,MAAM,IAAI,UACR,qBAAA,uBAAmB,OAAO,iBAAA,QAAA,yBAAA,KAAA,IAAA,KAAA,IAAA,qBAAa,SAAQ,SAAS,mBAC1D;CACF;CACA,IAAI,SAAS,WAAW,IAAI,MAAM;CAClC,IAAI,SAAS,aAAa,IAAI,MAAM;CACpC,IAAI,CAAC,UAAU,CAAC,QAAQ;EACtB,yBAAS,IAAI,IAAI;EACjB,yBAAS,IAAI,IAAI;EACjB,WAAW,IAAI,QAAQ,MAAM;EAC7B,aAAa,IAAI,QAAQ,MAAM;EAC/B,MAAM,aAAsC,OAAO,MAAM;EACzD,OAAO,eAAe,QAAQ,UAAU;GAAE,OAAO;GAAM,YAAY;GAAO,cAAc;EAAK,CAAC;EAC9F,OAAO,eAAe,QAAQ,gBAAgB;GAC5C,OAAO;GACP,YAAY;GACZ,cAAc;EAChB,CAAC;CACH;CACA,MAAM,QAAQ;CACd,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,OAAO,IAAI,GAAG,GAAG;EACrB,MAAM,OAAO,OAAO,yBAAyB,QAAQ,GAAG;EACxD,IAAI,QAAQ,CAAC,KAAK,cAChB,MAAM,IAAI,UAAU,oBAAoB,IAAI,sBAAsB;EAEpE,IAAI,QAAQ,WAAW,MAAM,MAAM,IAAI,KAAK,KAAK,KAAK;EACtD,OAAO,IAAI,GAAG;EACd,OAAO,eAAe,QAAQ,KAAK;GACjC,YAAY;GACZ,cAAc;GACd,WAAW,MAAM,IAAI,GAAG;GACxB,MAAM,SAAkB,KAAK,MAAM,IAAI,KAAK,IAAI;EAClD,CAAC;CACH;AACF;;AAKA,SAAS,WAAW,QAA0B;CAC5C,OAAO;EAAC;EAAQ,WAAW,MAAM;EAAG,mBAAmB,MAAM;EAAG,UAAU,MAAM;CAAC;AACnF;;AAGA,SAAgB,WAAW,KAA6B;CACtD,MAAM,OAAO,OAAO,QAAQ,WAAW,MAAM,IAAI;CACjD,MAAM,MAAgB,CAAC;CACvB,MAAM,WAAW,IAAI,OAAO,SAAS,QAAQ,GAAG,CAAC,CAAC,KAAK,IAAI;CAC3D,IAAI,UAAU;EACZ,MAAM,OAAO,KAAK,MAAM,SAAS,EAAE,CAAE,QAAQ,SAAS,QAAQ,SAAS,EAAE,CAAC,SAAS,CAAC;EACpF,MAAM,QAAQ,KAAK,QAAQ,GAAG;EAC9B,IAAI,UAAU,IAAI,IAAI,KAAK,KAAK,MAAM,QAAQ,CAAC,CAAC;CAClD;CACA,MAAM,aAAa,KAAK,QAAQ,GAAG;CACnC,IAAI,eAAe,IAAI;EACrB,MAAM,QAAQ,KAAK,MAAM,aAAa,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM;EAC7D,KAAK,MAAM,QAAQ,MAAM,MAAM,GAAG,GAAG;GACnC,MAAM,KAAK,KAAK,QAAQ,GAAG;GAC3B,IAAI,KAAK,KAAK,YAAY,IAAI,cAAc,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GACxE,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC;EAE/B;CACF;CACA,OAAO,IAAI,QAAQ,UAAU;AAC/B;;AAGA,SAAgB,eAAe,OAAgB,QAAQ,GAAG,MAAM,IAAc;CAC5E,IAAI,OAAO,UAAU,UAAU;EAC7B,IAAI,YAAY,GAAG,GAAG,OAAO,CAAC,KAAK;EACnC,OAAO,cAAc,KAAK,KAAK,KAAK,SAAS,GAAG,IAAI,WAAW,KAAK,IAAI,CAAC;CAC3E;CACA,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,QAAQ,WAAW,OAAO,CAAC;CACtE,IAAI,OAAO,QAAQ,eAAe,iBAAiB,KAAK,OAAO,WAAW,KAAK;CAC/E,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,SAAS,MAAM,eAAe,GAAG,QAAQ,GAAG,GAAG,CAAC;CACvF,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,CAAC;CACnC,MAAM,YAAY,IAAI,YAAY,MAAM;CACxC,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,WAAW;EACtD,IAAI,aAAa,OAAO,UAAU,UAAU,OAAO,CAAC,KAAK;EACzD,IAAI,YAAY,IAAI,KAAK,UAAU,QAAQ,OAAO,UAAU,UAC1D,OAAO,eAAe,OAAO,QAAQ,GAAG,QAAQ;EAElD,OAAO,eAAe,OAAO,QAAQ,GAAG,IAAI;CAC9C,CAAC;AACH;;AAGA,SAAgB,aAAa,MAAc,SAAkD;CAC3F,IAAI,MAAM,KAAK,QAAQ,UAAU,KAAK,SAAS,EAAE;CACjD,MAAM,MAAM,IAAI,IACd,QAAQ,SAAS,MAAO,KAAK,EAAE,UAAU,oBAAoB,WAAW,CAAC,IAAI,CAAC,CAAE,CAClF;CACA,KAAK,MAAM,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAC9D,IAAI,OAAO,UAAU,mBAAmB,MAAM,IAAI,MAAM,MAAM,CAAC,CAAC,KAAK,QAAQ;CAE/E,OAAO;AACT;;AAGA,SAAgB,WAAc,KAAQ,SAA0C,QAAQ,GAAM;CAC5F,IAAI,EAAE,eAAe,UAAU,QAAQ,GAAG,OAAO;CACjD,IAAI;EACF,IAAI,UAAU,aAAa,IAAI,SAAS,OAAO;EAC/C,IAAI,IAAI,OAAO,IAAI,QAAQ,aAAa,IAAI,OAAO,OAAO;EAC1D,WAAY,IAA4B,OAAO,SAAS,QAAQ,CAAC;CACnE,QAAQ,CAER;CACA,OAAO;AACT;;AAGA,SAAgB,UAAU,SAAgE;CACxF,QAAQ,QAAQ;EACd,MAAM,WAAW,KAAK,QAAQ,CAAC;CACjC;AACF"}
+{"version":3,"file":"secret-config--cVTOWwp.js","names":["SENSITIVE_KEY_NAMES","TRANSPORT_CONFIG_SECRET_NAMES","DEFAULT_REDACT_QUERY_PARAMS"],"sources":["../src/transports/secret-config.ts"],"sourcesContent":["/**\n * Keeps credentials out of serialized transport output and error text.\n *\n * `protectSecrets()` replaces each listed field with a non-enumerable accessor backed\n * by a WeakMap, whether or not the field is assigned yet, so later assignments (a\n * connection opened on first write, a refreshed token) stay hidden too. It also\n * installs `toJSON()` and a Node inspect hook returning a redacted view: scalar\n * fields stay for debugging, secret-looking keys become '[REDACTED]', URLs lose\n * userinfo, query and fragment. No Node imports, so browser bundles can use it.\n */\n\nimport { assignOwn } from '../utils/own-property';\nimport {\n  DEFAULT_REDACT_QUERY_PARAMS,\n  SENSITIVE_KEY_NAMES,\n  TRANSPORT_CONFIG_SECRET_NAMES,\n} from '../utils/sensitive-names';\n\nexport const REDACTED = '[REDACTED]';\n\nconst INSPECT_CUSTOM = Symbol.for('nodejs.util.inspect.custom');\nconst MAX_DEPTH = 4;\nconst MIN_SECRET_LENGTH = 4;\nconst SCHEME_PREFIX = /^[a-z][a-z0-9+.-]*:\\/\\//i;\n/** `scheme://userinfo@`: userinfo runs to the LAST `@` before the path, so `p@ss` is covered. */\nconst USERINFO = /(\\b[a-z][a-z0-9+.-]*:\\/\\/)[^\\s/?#]*@/gi;\n\nfunction normalizeName(name: string): string {\n  return name.toLowerCase().replaceAll('-', '').replaceAll('_', '');\n}\n\nconst SECRET_NAMES = [...SENSITIVE_KEY_NAMES, ...TRANSPORT_CONFIG_SECRET_NAMES].map(normalizeName);\nconst QUERY_NAMES = new Set(DEFAULT_REDACT_QUERY_PARAMS.map(normalizeName));\n\n/** Exact match for short names (`key`, `pfx`), suffix match for longer ones (`azureClientSecret`). */\nfunction isSecretKey(key: string): boolean {\n  const name = normalizeName(key);\n  return SECRET_NAMES.some((n) => name === n || (n.length >= 5 && name.endsWith(n)));\n}\n\nfunction isUrlKey(key: string): boolean {\n  return /url|uri|endpoint|href/i.test(key);\n}\n\nfunction isPlainObject(value: object): boolean {\n  const proto = Object.getPrototypeOf(value) as unknown;\n  return proto === Object.prototype || proto === null;\n}\n\nfunction safeDecode(value: string): string {\n  try {\n    return decodeURIComponent(value.replaceAll('+', ' '));\n  } catch {\n    return value;\n  }\n}\n\n/** Absolute URL: `scheme://host` only. Relative or unparseable: path kept, query and fragment cut. */\nexport function redactUrl(raw: string | URL): string {\n  if (typeof raw !== 'string') return `${raw.protocol}//${raw.host}`;\n  if (SCHEME_PREFIX.test(raw)) {\n    try {\n      const url = new URL(raw);\n      return `${url.protocol}//${url.host}`;\n    } catch {\n      return REDACTED;\n    }\n  }\n  return raw.split(/[?#]/, 1)[0] ?? '';\n}\n\nfunction redactHeaders(headers: unknown): unknown {\n  if (!headers || typeof headers !== 'object') return headers;\n  return Object.fromEntries(Object.keys(headers).map((name) => [name, REDACTED]));\n}\n\n/** Redacted deep copy of a config-like value. Never throws, never returns a secret. */\nexport function redactConfig(value: unknown, depth = 0, key = ''): unknown {\n  if (value === null || value === undefined) return value;\n  if (typeof value === 'string') {\n    return SCHEME_PREFIX.test(value) || isUrlKey(key) ? redactUrl(value) : value;\n  }\n  if (typeof value === 'number' || typeof value === 'boolean') return value;\n  if (typeof value === 'function') return '[Function]';\n  if (typeof value !== 'object') return '[Unserializable]';\n  if (typeof URL !== 'undefined' && value instanceof URL) return redactUrl(value);\n  if (Array.isArray(value)) {\n    return depth >= MAX_DEPTH ? '[Array]' : value.map((v) => redactConfig(v, depth + 1, key));\n  }\n  if (!isPlainObject(value) || depth >= MAX_DEPTH)\n    return `[${value.constructor?.name ?? 'Object'}]`;\n  const out: Record<string, unknown> = {};\n  for (const [name, inner] of Object.entries(value)) {\n    if (isSecretKey(name)) assignOwn(out, name, inner === undefined ? undefined : REDACTED);\n    else if (name.toLowerCase() === 'headers') assignOwn(out, name, redactHeaders(inner));\n    else assignOwn(out, name, redactConfig(inner, depth + 1, name));\n  }\n  return out;\n}\n\n// ── Secret protection ───────────────────────────────────────────────────────\n\nconst hiddenKeys = new WeakMap<object, Set<string>>();\nconst hiddenValues = new WeakMap<object, Map<string, unknown>>();\n\nfunction viewOf(target: object): Record<string, unknown> {\n  const hidden = hiddenKeys.get(target) ?? new Set<string>();\n  const values = hiddenValues.get(target);\n  const view: Record<string, unknown> = { class: target.constructor?.name };\n  for (const key of new Set([...Object.keys(target), ...hidden])) {\n    const inner = hidden.has(key) ? values?.get(key) : (target as Record<string, unknown>)[key];\n    if (isSecretKey(key)) view[key] = inner === undefined ? undefined : REDACTED;\n    else if (key.toLowerCase() === 'headers') view[key] = redactHeaders(inner);\n    else if (\n      inner !== null &&\n      typeof inner === 'object' &&\n      !hidden.has(key) &&\n      !(inner instanceof URL)\n    ) {\n      view[key] = '[Object]';\n    } else if (hidden.has(key) && typeof inner === 'string' && !isUrlKey(key)) {\n      view[key] = REDACTED;\n    } else view[key] = redactConfig(inner, 0, key);\n  }\n  return view;\n}\n\n/**\n * Hides `keys` on `target` (assigned or not yet) and gives it a redacted `toJSON()` /\n * inspect view. Fields stay readable and writable. Safe to call more than once.\n * Throws when the target cannot carry the protection (frozen or sealed), instead of\n * silently leaving the secret enumerable.\n */\nexport function protectSecrets(target: object, keys: readonly string[]): void {\n  if (!Object.isExtensible(target)) {\n    throw new TypeError(\n      `protectSecrets: ${target.constructor?.name ?? 'object'} is not extensible`\n    );\n  }\n  let hidden = hiddenKeys.get(target);\n  let values = hiddenValues.get(target);\n  if (!hidden || !values) {\n    hidden = new Set();\n    values = new Map();\n    hiddenKeys.set(target, hidden);\n    hiddenValues.set(target, values);\n    const view = (): Record<string, unknown> => viewOf(target);\n    Object.defineProperty(target, 'toJSON', { value: view, enumerable: false, configurable: true });\n    Object.defineProperty(target, INSPECT_CUSTOM, {\n      value: view,\n      enumerable: false,\n      configurable: true,\n    });\n  }\n  const store = values;\n  for (const key of keys) {\n    if (hidden.has(key)) continue;\n    const desc = Object.getOwnPropertyDescriptor(target, key);\n    if (desc && !desc.configurable) {\n      throw new TypeError(`protectSecrets: \"${key}\" is not configurable`);\n    }\n    if (desc && 'value' in desc) store.set(key, desc.value);\n    hidden.add(key);\n    Object.defineProperty(target, key, {\n      enumerable: false,\n      configurable: true,\n      get: () => store.get(key),\n      set: (next: unknown) => void store.set(key, next),\n    });\n  }\n}\n\n// ── Scrubbing error text ────────────────────────────────────────────────────\n\n/** The raw, decoded and percent-encoded spellings of a secret. */\nfunction variantsOf(secret: string): string[] {\n  return [secret, safeDecode(secret), encodeURIComponent(secret), encodeURI(secret)];\n}\n\n/** Secret parts of a URL string: the password and the values of sensitive query parameters. */\nexport function urlSecrets(raw: string | URL): string[] {\n  const text = typeof raw === 'string' ? raw : raw.href;\n  const out: string[] = [];\n  const userinfo = new RegExp(USERINFO.source, 'i').exec(text);\n  if (userinfo) {\n    const info = text.slice(userinfo[1]!.length, userinfo.index + userinfo[0].length - 1);\n    const colon = info.indexOf(':');\n    if (colon !== -1) out.push(info.slice(colon + 1));\n  }\n  const queryStart = text.indexOf('?');\n  if (queryStart !== -1) {\n    const query = text.slice(queryStart + 1).split('#', 1)[0] ?? '';\n    for (const pair of query.split('&')) {\n      const eq = pair.indexOf('=');\n      if (eq > 0 && QUERY_NAMES.has(normalizeName(safeDecode(pair.slice(0, eq))))) {\n        out.push(pair.slice(eq + 1));\n      }\n    }\n  }\n  return out.flatMap(variantsOf);\n}\n\n/** Every secret string held in a config-like value: secret-keyed values, header values, URL secrets. */\nexport function collectSecrets(value: unknown, depth = 0, key = ''): string[] {\n  if (typeof value === 'string') {\n    if (isSecretKey(key)) return [value];\n    return SCHEME_PREFIX.test(value) || isUrlKey(key) ? urlSecrets(value) : [];\n  }\n  if (!value || typeof value !== 'object' || depth > MAX_DEPTH) return [];\n  if (typeof URL !== 'undefined' && value instanceof URL) return urlSecrets(value);\n  if (Array.isArray(value)) return value.flatMap((v) => collectSecrets(v, depth + 1, key));\n  if (!isPlainObject(value)) return [];\n  const isHeaders = key.toLowerCase() === 'headers';\n  return Object.entries(value).flatMap(([name, inner]) => {\n    if (isHeaders && typeof inner === 'string') return [inner];\n    if (isSecretKey(name) && inner !== null && typeof inner === 'object') {\n      return collectSecrets(inner, depth + 1, 'secret');\n    }\n    return collectSecrets(inner, depth + 1, name);\n  });\n}\n\n/** Replaces URL userinfo and every spelling of the given secret values in `text`. */\nexport function scrubSecrets(text: string, secrets: readonly (string | undefined)[]): string {\n  let out = text.replace(USERINFO, `$1${REDACTED}@`);\n  const all = new Set(\n    secrets.flatMap((s) => (s && s.length >= MIN_SECRET_LENGTH ? variantsOf(s) : []))\n  );\n  for (const secret of [...all].sort((a, b) => b.length - a.length)) {\n    if (secret.length >= MIN_SECRET_LENGTH) out = out.split(secret).join(REDACTED);\n  }\n  return out;\n}\n\n/** Scrubs message, stack and the cause chain of `err` in place; returns it. */\nexport function scrubError<T>(err: T, secrets: readonly (string | undefined)[], depth = 0): T {\n  if (!(err instanceof Error) || depth > 3) return err;\n  try {\n    err.message = scrubSecrets(err.message, secrets);\n    if (err.stack) err.stack = scrubSecrets(err.stack, secrets);\n    scrubError((err as { cause?: unknown }).cause, secrets, depth + 1);\n  } catch {\n    /* frozen error: leave as is */\n  }\n  return err;\n}\n\n/** A `.catch()` handler that scrubs the secrets from the error, then rethrows it. */\nexport function scrubbing(secrets: () => (string | undefined)[]): (err: unknown) => never {\n  return (err) => {\n    throw scrubError(err, secrets());\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,MAAa,WAAW;AAExB,MAAM,iBAAiB,OAAO,IAAI,4BAA4B;AAC9D,MAAM,YAAY;AAClB,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;;AAEtB,MAAM,WAAW;AAEjB,SAAS,cAAc,MAAsB;CAC3C,OAAO,KAAK,YAAY,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,WAAW,KAAK,EAAE;AAClE;AAEA,MAAM,eAAe,CAAC,GAAGA,wBAAAA,qBAAqB,GAAGC,wBAAAA,6BAA6B,CAAC,CAAC,IAAI,aAAa;AACjG,MAAM,cAAc,IAAI,IAAIC,wBAAAA,4BAA4B,IAAI,aAAa,CAAC;;AAG1E,SAAS,YAAY,KAAsB;CACzC,MAAM,OAAO,cAAc,GAAG;CAC9B,OAAO,aAAa,MAAM,MAAM,SAAS,KAAM,EAAE,UAAU,KAAK,KAAK,SAAS,CAAC,CAAE;AACnF;AAEA,SAAS,SAAS,KAAsB;CACtC,OAAO,yBAAyB,KAAK,GAAG;AAC1C;AAEA,SAAS,cAAc,OAAwB;CAC7C,MAAM,QAAQ,OAAO,eAAe,KAAK;CACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,SAAS,WAAW,OAAuB;CACzC,IAAI;EACF,OAAO,mBAAmB,MAAM,WAAW,KAAK,GAAG,CAAC;CACtD,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,UAAU,KAA2B;CACnD,IAAI,OAAO,QAAQ,UAAU,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CAC5D,IAAI,cAAc,KAAK,GAAG,GACxB,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,GAAG;EACvB,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN,OAAO;CACT;CAEF,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,MAAM;AACpC;AAEA,SAAS,cAAc,SAA2B;CAChD,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU,OAAO;CACpD,OAAO,OAAO,YAAY,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,QAAQ,CAAC,CAAC;AAChF;;AAGA,SAAgB,aAAa,OAAgB,QAAQ,GAAG,MAAM,IAAa;;CACzE,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,OAAO;CAClD,IAAI,OAAO,UAAU,UACnB,OAAO,cAAc,KAAK,KAAK,KAAK,SAAS,GAAG,IAAI,UAAU,KAAK,IAAI;CAEzE,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW,OAAO;CACpE,IAAI,OAAO,UAAU,YAAY,OAAO;CACxC,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,OAAO,QAAQ,eAAe,iBAAiB,KAAK,OAAO,UAAU,KAAK;CAC9E,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,SAAS,YAAY,YAAY,MAAM,KAAK,MAAM,aAAa,GAAG,QAAQ,GAAG,GAAG,CAAC;CAE1F,IAAI,CAAC,cAAc,KAAK,KAAK,SAAS,WACpC,OAAO,MAAA,qBAAI,MAAM,iBAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAa,SAAQ,SAAS;CACjD,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,GAC9C,IAAI,YAAY,IAAI,GAAG,qBAAA,UAAU,KAAK,MAAM,UAAU,KAAA,IAAY,KAAA,IAAY,QAAQ;MACjF,IAAI,KAAK,YAAY,MAAM,WAAW,qBAAA,UAAU,KAAK,MAAM,cAAc,KAAK,CAAC;MAC/E,qBAAA,UAAU,KAAK,MAAM,aAAa,OAAO,QAAQ,GAAG,IAAI,CAAC;CAEhE,OAAO;AACT;AAIA,MAAM,6BAAa,IAAI,QAA6B;AACpD,MAAM,+BAAe,IAAI,QAAsC;AAE/D,SAAS,OAAO,QAAyC;;CACvD,MAAM,SAAS,WAAW,IAAI,MAAM,qBAAK,IAAI,IAAY;CACzD,MAAM,SAAS,aAAa,IAAI,MAAM;CACtC,MAAM,OAAgC,EAAE,QAAA,sBAAO,OAAO,iBAAA,QAAA,wBAAA,KAAA,IAAA,KAAA,IAAA,oBAAa,KAAK;CACxE,KAAK,MAAM,uBAAO,IAAI,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;EAC9D,MAAM,QAAQ,OAAO,IAAI,GAAG,IAAA,WAAA,QAAA,WAAA,KAAA,IAAA,KAAA,IAAI,OAAQ,IAAI,GAAG,IAAK,OAAmC;EACvF,IAAI,YAAY,GAAG,GAAG,KAAK,OAAO,UAAU,KAAA,IAAY,KAAA,IAAY;OAC/D,IAAI,IAAI,YAAY,MAAM,WAAW,KAAK,OAAO,cAAc,KAAK;OACpE,IACH,UAAU,QACV,OAAO,UAAU,YACjB,CAAC,OAAO,IAAI,GAAG,KACf,EAAE,iBAAiB,MAEnB,KAAK,OAAO;OACP,IAAI,OAAO,IAAI,GAAG,KAAK,OAAO,UAAU,YAAY,CAAC,SAAS,GAAG,GACtE,KAAK,OAAO;OACP,KAAK,OAAO,aAAa,OAAO,GAAG,GAAG;CAC/C;CACA,OAAO;AACT;;;;;;;AAQA,SAAgB,eAAe,QAAgB,MAA+B;CAC5E,IAAI,CAAC,OAAO,aAAa,MAAM,GAAG;;EAChC,MAAM,IAAI,UACR,qBAAA,uBAAmB,OAAO,iBAAA,QAAA,yBAAA,KAAA,IAAA,KAAA,IAAA,qBAAa,SAAQ,SAAS,mBAC1D;CACF;CACA,IAAI,SAAS,WAAW,IAAI,MAAM;CAClC,IAAI,SAAS,aAAa,IAAI,MAAM;CACpC,IAAI,CAAC,UAAU,CAAC,QAAQ;EACtB,yBAAS,IAAI,IAAI;EACjB,yBAAS,IAAI,IAAI;EACjB,WAAW,IAAI,QAAQ,MAAM;EAC7B,aAAa,IAAI,QAAQ,MAAM;EAC/B,MAAM,aAAsC,OAAO,MAAM;EACzD,OAAO,eAAe,QAAQ,UAAU;GAAE,OAAO;GAAM,YAAY;GAAO,cAAc;EAAK,CAAC;EAC9F,OAAO,eAAe,QAAQ,gBAAgB;GAC5C,OAAO;GACP,YAAY;GACZ,cAAc;EAChB,CAAC;CACH;CACA,MAAM,QAAQ;CACd,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,OAAO,IAAI,GAAG,GAAG;EACrB,MAAM,OAAO,OAAO,yBAAyB,QAAQ,GAAG;EACxD,IAAI,QAAQ,CAAC,KAAK,cAChB,MAAM,IAAI,UAAU,oBAAoB,IAAI,sBAAsB;EAEpE,IAAI,QAAQ,WAAW,MAAM,MAAM,IAAI,KAAK,KAAK,KAAK;EACtD,OAAO,IAAI,GAAG;EACd,OAAO,eAAe,QAAQ,KAAK;GACjC,YAAY;GACZ,cAAc;GACd,WAAW,MAAM,IAAI,GAAG;GACxB,MAAM,SAAkB,KAAK,MAAM,IAAI,KAAK,IAAI;EAClD,CAAC;CACH;AACF;;AAKA,SAAS,WAAW,QAA0B;CAC5C,OAAO;EAAC;EAAQ,WAAW,MAAM;EAAG,mBAAmB,MAAM;EAAG,UAAU,MAAM;CAAC;AACnF;;AAGA,SAAgB,WAAW,KAA6B;CACtD,MAAM,OAAO,OAAO,QAAQ,WAAW,MAAM,IAAI;CACjD,MAAM,MAAgB,CAAC;CACvB,MAAM,WAAW,IAAI,OAAO,SAAS,QAAQ,GAAG,CAAC,CAAC,KAAK,IAAI;CAC3D,IAAI,UAAU;EACZ,MAAM,OAAO,KAAK,MAAM,SAAS,EAAE,CAAE,QAAQ,SAAS,QAAQ,SAAS,EAAE,CAAC,SAAS,CAAC;EACpF,MAAM,QAAQ,KAAK,QAAQ,GAAG;EAC9B,IAAI,UAAU,IAAI,IAAI,KAAK,KAAK,MAAM,QAAQ,CAAC,CAAC;CAClD;CACA,MAAM,aAAa,KAAK,QAAQ,GAAG;CACnC,IAAI,eAAe,IAAI;EACrB,MAAM,QAAQ,KAAK,MAAM,aAAa,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM;EAC7D,KAAK,MAAM,QAAQ,MAAM,MAAM,GAAG,GAAG;GACnC,MAAM,KAAK,KAAK,QAAQ,GAAG;GAC3B,IAAI,KAAK,KAAK,YAAY,IAAI,cAAc,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GACxE,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC;EAE/B;CACF;CACA,OAAO,IAAI,QAAQ,UAAU;AAC/B;;AAGA,SAAgB,eAAe,OAAgB,QAAQ,GAAG,MAAM,IAAc;CAC5E,IAAI,OAAO,UAAU,UAAU;EAC7B,IAAI,YAAY,GAAG,GAAG,OAAO,CAAC,KAAK;EACnC,OAAO,cAAc,KAAK,KAAK,KAAK,SAAS,GAAG,IAAI,WAAW,KAAK,IAAI,CAAC;CAC3E;CACA,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,QAAQ,WAAW,OAAO,CAAC;CACtE,IAAI,OAAO,QAAQ,eAAe,iBAAiB,KAAK,OAAO,WAAW,KAAK;CAC/E,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,SAAS,MAAM,eAAe,GAAG,QAAQ,GAAG,GAAG,CAAC;CACvF,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,CAAC;CACnC,MAAM,YAAY,IAAI,YAAY,MAAM;CACxC,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,WAAW;EACtD,IAAI,aAAa,OAAO,UAAU,UAAU,OAAO,CAAC,KAAK;EACzD,IAAI,YAAY,IAAI,KAAK,UAAU,QAAQ,OAAO,UAAU,UAC1D,OAAO,eAAe,OAAO,QAAQ,GAAG,QAAQ;EAElD,OAAO,eAAe,OAAO,QAAQ,GAAG,IAAI;CAC9C,CAAC;AACH;;AAGA,SAAgB,aAAa,MAAc,SAAkD;CAC3F,IAAI,MAAM,KAAK,QAAQ,UAAU,KAAK,SAAS,EAAE;CACjD,MAAM,MAAM,IAAI,IACd,QAAQ,SAAS,MAAO,KAAK,EAAE,UAAU,oBAAoB,WAAW,CAAC,IAAI,CAAC,CAAE,CAClF;CACA,KAAK,MAAM,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAC9D,IAAI,OAAO,UAAU,mBAAmB,MAAM,IAAI,MAAM,MAAM,CAAC,CAAC,KAAK,QAAQ;CAE/E,OAAO;AACT;;AAGA,SAAgB,WAAc,KAAQ,SAA0C,QAAQ,GAAM;CAC5F,IAAI,EAAE,eAAe,UAAU,QAAQ,GAAG,OAAO;CACjD,IAAI;EACF,IAAI,UAAU,aAAa,IAAI,SAAS,OAAO;EAC/C,IAAI,IAAI,OAAO,IAAI,QAAQ,aAAa,IAAI,OAAO,OAAO;EAC1D,WAAY,IAA4B,OAAO,SAAS,QAAQ,CAAC;CACnE,QAAQ,CAER;CACA,OAAO;AACT;;AAGA,SAAgB,UAAU,SAAgE;CACxF,QAAQ,QAAQ;EACd,MAAM,WAAW,KAAK,QAAQ,CAAC;CACjC;AACF"}

package/dist/{secret-config-ByGq7kJd.mjs → secret-config-GKmb15Me.mjs}

@@ -1,4 +1,5 @@
-import { i as TRANSPORT_CONFIG_SECRET_NAMES, l as assignOwn, n as DEFAULT_REDACT_QUERY_PARAMS, r as SENSITIVE_KEY_NAMES } from "./sensitive-names-o__1PUUR.mjs";
+import { t as assignOwn } from "./own-property-CjFw9qwZ.mjs";
+import { i as TRANSPORT_CONFIG_SECRET_NAMES, n as DEFAULT_REDACT_QUERY_PARAMS, r as SENSITIVE_KEY_NAMES } from "./sensitive-names-BiBM6R1X.mjs";
 // src/transports/secret-config.ts
 /**
 * Keeps credentials out of serialized transport output and error text.
@@ -206,4 +207,4 @@ function scrubbing(secrets) {
 }
 export { scrubbing as a, scrubSecrets as i, protectSecrets as n, urlSecrets as o, scrubError as r, collectSecrets as t };
 
-//# sourceMappingURL=secret-config-ByGq7kJd.mjs.map
+//# sourceMappingURL=secret-config-GKmb15Me.mjs.map

package/dist/{secret-config-ByGq7kJd.mjs.map → secret-config-GKmb15Me.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"secret-config-ByGq7kJd.mjs","names":[],"sources":["../src/transports/secret-config.ts"],"sourcesContent":["/**\n * Keeps credentials out of serialized transport output and error text.\n *\n * `protectSecrets()` replaces each listed field with a non-enumerable accessor backed\n * by a WeakMap, whether or not the field is assigned yet, so later assignments (a\n * connection opened on first write, a refreshed token) stay hidden too. It also\n * installs `toJSON()` and a Node inspect hook returning a redacted view: scalar\n * fields stay for debugging, secret-looking keys become '[REDACTED]', URLs lose\n * userinfo, query and fragment. No Node imports, so browser bundles can use it.\n */\n\nimport { assignOwn } from '../utils/own-property';\nimport {\n  DEFAULT_REDACT_QUERY_PARAMS,\n  SENSITIVE_KEY_NAMES,\n  TRANSPORT_CONFIG_SECRET_NAMES,\n} from '../utils/sensitive-names';\n\nexport const REDACTED = '[REDACTED]';\n\nconst INSPECT_CUSTOM = Symbol.for('nodejs.util.inspect.custom');\nconst MAX_DEPTH = 4;\nconst MIN_SECRET_LENGTH = 4;\nconst SCHEME_PREFIX = /^[a-z][a-z0-9+.-]*:\\/\\//i;\n/** `scheme://userinfo@`: userinfo runs to the LAST `@` before the path, so `p@ss` is covered. */\nconst USERINFO = /(\\b[a-z][a-z0-9+.-]*:\\/\\/)[^\\s/?#]*@/gi;\n\nfunction normalizeName(name: string): string {\n  return name.toLowerCase().replaceAll('-', '').replaceAll('_', '');\n}\n\nconst SECRET_NAMES = [...SENSITIVE_KEY_NAMES, ...TRANSPORT_CONFIG_SECRET_NAMES].map(normalizeName);\nconst QUERY_NAMES = new Set(DEFAULT_REDACT_QUERY_PARAMS.map(normalizeName));\n\n/** Exact match for short names (`key`, `pfx`), suffix match for longer ones (`azureClientSecret`). */\nfunction isSecretKey(key: string): boolean {\n  const name = normalizeName(key);\n  return SECRET_NAMES.some((n) => name === n || (n.length >= 5 && name.endsWith(n)));\n}\n\nfunction isUrlKey(key: string): boolean {\n  return /url|uri|endpoint|href/i.test(key);\n}\n\nfunction isPlainObject(value: object): boolean {\n  const proto = Object.getPrototypeOf(value) as unknown;\n  return proto === Object.prototype || proto === null;\n}\n\nfunction safeDecode(value: string): string {\n  try {\n    return decodeURIComponent(value.replaceAll('+', ' '));\n  } catch {\n    return value;\n  }\n}\n\n/** Absolute URL: `scheme://host` only. Relative or unparseable: path kept, query and fragment cut. */\nexport function redactUrl(raw: string | URL): string {\n  if (typeof raw !== 'string') return `${raw.protocol}//${raw.host}`;\n  if (SCHEME_PREFIX.test(raw)) {\n    try {\n      const url = new URL(raw);\n      return `${url.protocol}//${url.host}`;\n    } catch {\n      return REDACTED;\n    }\n  }\n  return raw.split(/[?#]/, 1)[0] ?? '';\n}\n\nfunction redactHeaders(headers: unknown): unknown {\n  if (!headers || typeof headers !== 'object') return headers;\n  return Object.fromEntries(Object.keys(headers).map((name) => [name, REDACTED]));\n}\n\n/** Redacted deep copy of a config-like value. Never throws, never returns a secret. */\nexport function redactConfig(value: unknown, depth = 0, key = ''): unknown {\n  if (value === null || value === undefined) return value;\n  if (typeof value === 'string') {\n    return SCHEME_PREFIX.test(value) || isUrlKey(key) ? redactUrl(value) : value;\n  }\n  if (typeof value === 'number' || typeof value === 'boolean') return value;\n  if (typeof value === 'function') return '[Function]';\n  if (typeof value !== 'object') return '[Unserializable]';\n  if (typeof URL !== 'undefined' && value instanceof URL) return redactUrl(value);\n  if (Array.isArray(value)) {\n    return depth >= MAX_DEPTH ? '[Array]' : value.map((v) => redactConfig(v, depth + 1, key));\n  }\n  if (!isPlainObject(value) || depth >= MAX_DEPTH)\n    return `[${value.constructor?.name ?? 'Object'}]`;\n  const out: Record<string, unknown> = {};\n  for (const [name, inner] of Object.entries(value)) {\n    if (isSecretKey(name)) assignOwn(out, name, inner === undefined ? undefined : REDACTED);\n    else if (name.toLowerCase() === 'headers') assignOwn(out, name, redactHeaders(inner));\n    else assignOwn(out, name, redactConfig(inner, depth + 1, name));\n  }\n  return out;\n}\n\n// ── Secret protection ───────────────────────────────────────────────────────\n\nconst hiddenKeys = new WeakMap<object, Set<string>>();\nconst hiddenValues = new WeakMap<object, Map<string, unknown>>();\n\nfunction viewOf(target: object): Record<string, unknown> {\n  const hidden = hiddenKeys.get(target) ?? new Set<string>();\n  const values = hiddenValues.get(target);\n  const view: Record<string, unknown> = { class: target.constructor?.name };\n  for (const key of new Set([...Object.keys(target), ...hidden])) {\n    const inner = hidden.has(key) ? values?.get(key) : (target as Record<string, unknown>)[key];\n    if (isSecretKey(key)) view[key] = inner === undefined ? undefined : REDACTED;\n    else if (key.toLowerCase() === 'headers') view[key] = redactHeaders(inner);\n    else if (\n      inner !== null &&\n      typeof inner === 'object' &&\n      !hidden.has(key) &&\n      !(inner instanceof URL)\n    ) {\n      view[key] = '[Object]';\n    } else if (hidden.has(key) && typeof inner === 'string' && !isUrlKey(key)) {\n      view[key] = REDACTED;\n    } else view[key] = redactConfig(inner, 0, key);\n  }\n  return view;\n}\n\n/**\n * Hides `keys` on `target` (assigned or not yet) and gives it a redacted `toJSON()` /\n * inspect view. Fields stay readable and writable. Safe to call more than once.\n * Throws when the target cannot carry the protection (frozen or sealed), instead of\n * silently leaving the secret enumerable.\n */\nexport function protectSecrets(target: object, keys: readonly string[]): void {\n  if (!Object.isExtensible(target)) {\n    throw new TypeError(\n      `protectSecrets: ${target.constructor?.name ?? 'object'} is not extensible`\n    );\n  }\n  let hidden = hiddenKeys.get(target);\n  let values = hiddenValues.get(target);\n  if (!hidden || !values) {\n    hidden = new Set();\n    values = new Map();\n    hiddenKeys.set(target, hidden);\n    hiddenValues.set(target, values);\n    const view = (): Record<string, unknown> => viewOf(target);\n    Object.defineProperty(target, 'toJSON', { value: view, enumerable: false, configurable: true });\n    Object.defineProperty(target, INSPECT_CUSTOM, {\n      value: view,\n      enumerable: false,\n      configurable: true,\n    });\n  }\n  const store = values;\n  for (const key of keys) {\n    if (hidden.has(key)) continue;\n    const desc = Object.getOwnPropertyDescriptor(target, key);\n    if (desc && !desc.configurable) {\n      throw new TypeError(`protectSecrets: \"${key}\" is not configurable`);\n    }\n    if (desc && 'value' in desc) store.set(key, desc.value);\n    hidden.add(key);\n    Object.defineProperty(target, key, {\n      enumerable: false,\n      configurable: true,\n      get: () => store.get(key),\n      set: (next: unknown) => void store.set(key, next),\n    });\n  }\n}\n\n// ── Scrubbing error text ────────────────────────────────────────────────────\n\n/** The raw, decoded and percent-encoded spellings of a secret. */\nfunction variantsOf(secret: string): string[] {\n  return [secret, safeDecode(secret), encodeURIComponent(secret), encodeURI(secret)];\n}\n\n/** Secret parts of a URL string: the password and the values of sensitive query parameters. */\nexport function urlSecrets(raw: string | URL): string[] {\n  const text = typeof raw === 'string' ? raw : raw.href;\n  const out: string[] = [];\n  const userinfo = new RegExp(USERINFO.source, 'i').exec(text);\n  if (userinfo) {\n    const info = text.slice(userinfo[1]!.length, userinfo.index + userinfo[0].length - 1);\n    const colon = info.indexOf(':');\n    if (colon !== -1) out.push(info.slice(colon + 1));\n  }\n  const queryStart = text.indexOf('?');\n  if (queryStart !== -1) {\n    const query = text.slice(queryStart + 1).split('#', 1)[0] ?? '';\n    for (const pair of query.split('&')) {\n      const eq = pair.indexOf('=');\n      if (eq > 0 && QUERY_NAMES.has(normalizeName(safeDecode(pair.slice(0, eq))))) {\n        out.push(pair.slice(eq + 1));\n      }\n    }\n  }\n  return out.flatMap(variantsOf);\n}\n\n/** Every secret string held in a config-like value: secret-keyed values, header values, URL secrets. */\nexport function collectSecrets(value: unknown, depth = 0, key = ''): string[] {\n  if (typeof value === 'string') {\n    if (isSecretKey(key)) return [value];\n    return SCHEME_PREFIX.test(value) || isUrlKey(key) ? urlSecrets(value) : [];\n  }\n  if (!value || typeof value !== 'object' || depth > MAX_DEPTH) return [];\n  if (typeof URL !== 'undefined' && value instanceof URL) return urlSecrets(value);\n  if (Array.isArray(value)) return value.flatMap((v) => collectSecrets(v, depth + 1, key));\n  if (!isPlainObject(value)) return [];\n  const isHeaders = key.toLowerCase() === 'headers';\n  return Object.entries(value).flatMap(([name, inner]) => {\n    if (isHeaders && typeof inner === 'string') return [inner];\n    if (isSecretKey(name) && inner !== null && typeof inner === 'object') {\n      return collectSecrets(inner, depth + 1, 'secret');\n    }\n    return collectSecrets(inner, depth + 1, name);\n  });\n}\n\n/** Replaces URL userinfo and every spelling of the given secret values in `text`. */\nexport function scrubSecrets(text: string, secrets: readonly (string | undefined)[]): string {\n  let out = text.replace(USERINFO, `$1${REDACTED}@`);\n  const all = new Set(\n    secrets.flatMap((s) => (s && s.length >= MIN_SECRET_LENGTH ? variantsOf(s) : []))\n  );\n  for (const secret of [...all].sort((a, b) => b.length - a.length)) {\n    if (secret.length >= MIN_SECRET_LENGTH) out = out.split(secret).join(REDACTED);\n  }\n  return out;\n}\n\n/** Scrubs message, stack and the cause chain of `err` in place; returns it. */\nexport function scrubError<T>(err: T, secrets: readonly (string | undefined)[], depth = 0): T {\n  if (!(err instanceof Error) || depth > 3) return err;\n  try {\n    err.message = scrubSecrets(err.message, secrets);\n    if (err.stack) err.stack = scrubSecrets(err.stack, secrets);\n    scrubError((err as { cause?: unknown }).cause, secrets, depth + 1);\n  } catch {\n    /* frozen error: leave as is */\n  }\n  return err;\n}\n\n/** A `.catch()` handler that scrubs the secrets from the error, then rethrows it. */\nexport function scrubbing(secrets: () => (string | undefined)[]): (err: unknown) => never {\n  return (err) => {\n    throw scrubError(err, secrets());\n  };\n}\n"],"mappings":";;;;;;;;;;;;AAkBA,MAAa,WAAW;AAExB,MAAM,iBAAiB,OAAO,IAAI,4BAA4B;AAC9D,MAAM,YAAY;AAClB,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;;AAEtB,MAAM,WAAW;AAEjB,SAAS,cAAc,MAAsB;CAC3C,OAAO,KAAK,YAAY,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,WAAW,KAAK,EAAE;AAClE;AAEA,MAAM,eAAe,CAAC,GAAG,qBAAqB,GAAG,6BAA6B,CAAC,CAAC,IAAI,aAAa;AACjG,MAAM,cAAc,IAAI,IAAI,4BAA4B,IAAI,aAAa,CAAC;;AAG1E,SAAS,YAAY,KAAsB;CACzC,MAAM,OAAO,cAAc,GAAG;CAC9B,OAAO,aAAa,MAAM,MAAM,SAAS,KAAM,EAAE,UAAU,KAAK,KAAK,SAAS,CAAC,CAAE;AACnF;AAEA,SAAS,SAAS,KAAsB;CACtC,OAAO,yBAAyB,KAAK,GAAG;AAC1C;AAEA,SAAS,cAAc,OAAwB;CAC7C,MAAM,QAAQ,OAAO,eAAe,KAAK;CACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,SAAS,WAAW,OAAuB;CACzC,IAAI;EACF,OAAO,mBAAmB,MAAM,WAAW,KAAK,GAAG,CAAC;CACtD,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,UAAU,KAA2B;CACnD,IAAI,OAAO,QAAQ,UAAU,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CAC5D,IAAI,cAAc,KAAK,GAAG,GACxB,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,GAAG;EACvB,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN,OAAO;CACT;CAEF,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,MAAM;AACpC;AAEA,SAAS,cAAc,SAA2B;CAChD,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU,OAAO;CACpD,OAAO,OAAO,YAAY,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,QAAQ,CAAC,CAAC;AAChF;;AAGA,SAAgB,aAAa,OAAgB,QAAQ,GAAG,MAAM,IAAa;;CACzE,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,OAAO;CAClD,IAAI,OAAO,UAAU,UACnB,OAAO,cAAc,KAAK,KAAK,KAAK,SAAS,GAAG,IAAI,UAAU,KAAK,IAAI;CAEzE,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW,OAAO;CACpE,IAAI,OAAO,UAAU,YAAY,OAAO;CACxC,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,OAAO,QAAQ,eAAe,iBAAiB,KAAK,OAAO,UAAU,KAAK;CAC9E,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,SAAS,YAAY,YAAY,MAAM,KAAK,MAAM,aAAa,GAAG,QAAQ,GAAG,GAAG,CAAC;CAE1F,IAAI,CAAC,cAAc,KAAK,KAAK,SAAS,WACpC,OAAO,MAAA,qBAAI,MAAM,iBAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAa,SAAQ,SAAS;CACjD,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,GAC9C,IAAI,YAAY,IAAI,GAAG,UAAU,KAAK,MAAM,UAAU,KAAA,IAAY,KAAA,IAAY,QAAQ;MACjF,IAAI,KAAK,YAAY,MAAM,WAAW,UAAU,KAAK,MAAM,cAAc,KAAK,CAAC;MAC/E,UAAU,KAAK,MAAM,aAAa,OAAO,QAAQ,GAAG,IAAI,CAAC;CAEhE,OAAO;AACT;AAIA,MAAM,6BAAa,IAAI,QAA6B;AACpD,MAAM,+BAAe,IAAI,QAAsC;AAE/D,SAAS,OAAO,QAAyC;;CACvD,MAAM,SAAS,WAAW,IAAI,MAAM,qBAAK,IAAI,IAAY;CACzD,MAAM,SAAS,aAAa,IAAI,MAAM;CACtC,MAAM,OAAgC,EAAE,QAAA,sBAAO,OAAO,iBAAA,QAAA,wBAAA,KAAA,IAAA,KAAA,IAAA,oBAAa,KAAK;CACxE,KAAK,MAAM,uBAAO,IAAI,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;EAC9D,MAAM,QAAQ,OAAO,IAAI,GAAG,IAAA,WAAA,QAAA,WAAA,KAAA,IAAA,KAAA,IAAI,OAAQ,IAAI,GAAG,IAAK,OAAmC;EACvF,IAAI,YAAY,GAAG,GAAG,KAAK,OAAO,UAAU,KAAA,IAAY,KAAA,IAAY;OAC/D,IAAI,IAAI,YAAY,MAAM,WAAW,KAAK,OAAO,cAAc,KAAK;OACpE,IACH,UAAU,QACV,OAAO,UAAU,YACjB,CAAC,OAAO,IAAI,GAAG,KACf,EAAE,iBAAiB,MAEnB,KAAK,OAAO;OACP,IAAI,OAAO,IAAI,GAAG,KAAK,OAAO,UAAU,YAAY,CAAC,SAAS,GAAG,GACtE,KAAK,OAAO;OACP,KAAK,OAAO,aAAa,OAAO,GAAG,GAAG;CAC/C;CACA,OAAO;AACT;;;;;;;AAQA,SAAgB,eAAe,QAAgB,MAA+B;CAC5E,IAAI,CAAC,OAAO,aAAa,MAAM,GAAG;;EAChC,MAAM,IAAI,UACR,qBAAA,uBAAmB,OAAO,iBAAA,QAAA,yBAAA,KAAA,IAAA,KAAA,IAAA,qBAAa,SAAQ,SAAS,mBAC1D;CACF;CACA,IAAI,SAAS,WAAW,IAAI,MAAM;CAClC,IAAI,SAAS,aAAa,IAAI,MAAM;CACpC,IAAI,CAAC,UAAU,CAAC,QAAQ;EACtB,yBAAS,IAAI,IAAI;EACjB,yBAAS,IAAI,IAAI;EACjB,WAAW,IAAI,QAAQ,MAAM;EAC7B,aAAa,IAAI,QAAQ,MAAM;EAC/B,MAAM,aAAsC,OAAO,MAAM;EACzD,OAAO,eAAe,QAAQ,UAAU;GAAE,OAAO;GAAM,YAAY;GAAO,cAAc;EAAK,CAAC;EAC9F,OAAO,eAAe,QAAQ,gBAAgB;GAC5C,OAAO;GACP,YAAY;GACZ,cAAc;EAChB,CAAC;CACH;CACA,MAAM,QAAQ;CACd,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,OAAO,IAAI,GAAG,GAAG;EACrB,MAAM,OAAO,OAAO,yBAAyB,QAAQ,GAAG;EACxD,IAAI,QAAQ,CAAC,KAAK,cAChB,MAAM,IAAI,UAAU,oBAAoB,IAAI,sBAAsB;EAEpE,IAAI,QAAQ,WAAW,MAAM,MAAM,IAAI,KAAK,KAAK,KAAK;EACtD,OAAO,IAAI,GAAG;EACd,OAAO,eAAe,QAAQ,KAAK;GACjC,YAAY;GACZ,cAAc;GACd,WAAW,MAAM,IAAI,GAAG;GACxB,MAAM,SAAkB,KAAK,MAAM,IAAI,KAAK,IAAI;EAClD,CAAC;CACH;AACF;;AAKA,SAAS,WAAW,QAA0B;CAC5C,OAAO;EAAC;EAAQ,WAAW,MAAM;EAAG,mBAAmB,MAAM;EAAG,UAAU,MAAM;CAAC;AACnF;;AAGA,SAAgB,WAAW,KAA6B;CACtD,MAAM,OAAO,OAAO,QAAQ,WAAW,MAAM,IAAI;CACjD,MAAM,MAAgB,CAAC;CACvB,MAAM,WAAW,IAAI,OAAO,SAAS,QAAQ,GAAG,CAAC,CAAC,KAAK,IAAI;CAC3D,IAAI,UAAU;EACZ,MAAM,OAAO,KAAK,MAAM,SAAS,EAAE,CAAE,QAAQ,SAAS,QAAQ,SAAS,EAAE,CAAC,SAAS,CAAC;EACpF,MAAM,QAAQ,KAAK,QAAQ,GAAG;EAC9B,IAAI,UAAU,IAAI,IAAI,KAAK,KAAK,MAAM,QAAQ,CAAC,CAAC;CAClD;CACA,MAAM,aAAa,KAAK,QAAQ,GAAG;CACnC,IAAI,eAAe,IAAI;EACrB,MAAM,QAAQ,KAAK,MAAM,aAAa,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM;EAC7D,KAAK,MAAM,QAAQ,MAAM,MAAM,GAAG,GAAG;GACnC,MAAM,KAAK,KAAK,QAAQ,GAAG;GAC3B,IAAI,KAAK,KAAK,YAAY,IAAI,cAAc,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GACxE,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC;EAE/B;CACF;CACA,OAAO,IAAI,QAAQ,UAAU;AAC/B;;AAGA,SAAgB,eAAe,OAAgB,QAAQ,GAAG,MAAM,IAAc;CAC5E,IAAI,OAAO,UAAU,UAAU;EAC7B,IAAI,YAAY,GAAG,GAAG,OAAO,CAAC,KAAK;EACnC,OAAO,cAAc,KAAK,KAAK,KAAK,SAAS,GAAG,IAAI,WAAW,KAAK,IAAI,CAAC;CAC3E;CACA,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,QAAQ,WAAW,OAAO,CAAC;CACtE,IAAI,OAAO,QAAQ,eAAe,iBAAiB,KAAK,OAAO,WAAW,KAAK;CAC/E,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,SAAS,MAAM,eAAe,GAAG,QAAQ,GAAG,GAAG,CAAC;CACvF,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,CAAC;CACnC,MAAM,YAAY,IAAI,YAAY,MAAM;CACxC,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,WAAW;EACtD,IAAI,aAAa,OAAO,UAAU,UAAU,OAAO,CAAC,KAAK;EACzD,IAAI,YAAY,IAAI,KAAK,UAAU,QAAQ,OAAO,UAAU,UAC1D,OAAO,eAAe,OAAO,QAAQ,GAAG,QAAQ;EAElD,OAAO,eAAe,OAAO,QAAQ,GAAG,IAAI;CAC9C,CAAC;AACH;;AAGA,SAAgB,aAAa,MAAc,SAAkD;CAC3F,IAAI,MAAM,KAAK,QAAQ,UAAU,KAAK,SAAS,EAAE;CACjD,MAAM,MAAM,IAAI,IACd,QAAQ,SAAS,MAAO,KAAK,EAAE,UAAU,oBAAoB,WAAW,CAAC,IAAI,CAAC,CAAE,CAClF;CACA,KAAK,MAAM,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAC9D,IAAI,OAAO,UAAU,mBAAmB,MAAM,IAAI,MAAM,MAAM,CAAC,CAAC,KAAK,QAAQ;CAE/E,OAAO;AACT;;AAGA,SAAgB,WAAc,KAAQ,SAA0C,QAAQ,GAAM;CAC5F,IAAI,EAAE,eAAe,UAAU,QAAQ,GAAG,OAAO;CACjD,IAAI;EACF,IAAI,UAAU,aAAa,IAAI,SAAS,OAAO;EAC/C,IAAI,IAAI,OAAO,IAAI,QAAQ,aAAa,IAAI,OAAO,OAAO;EAC1D,WAAY,IAA4B,OAAO,SAAS,QAAQ,CAAC;CACnE,QAAQ,CAER;CACA,OAAO;AACT;;AAGA,SAAgB,UAAU,SAAgE;CACxF,QAAQ,QAAQ;EACd,MAAM,WAAW,KAAK,QAAQ,CAAC;CACjC;AACF"}
+{"version":3,"file":"secret-config-GKmb15Me.mjs","names":[],"sources":["../src/transports/secret-config.ts"],"sourcesContent":["/**\n * Keeps credentials out of serialized transport output and error text.\n *\n * `protectSecrets()` replaces each listed field with a non-enumerable accessor backed\n * by a WeakMap, whether or not the field is assigned yet, so later assignments (a\n * connection opened on first write, a refreshed token) stay hidden too. It also\n * installs `toJSON()` and a Node inspect hook returning a redacted view: scalar\n * fields stay for debugging, secret-looking keys become '[REDACTED]', URLs lose\n * userinfo, query and fragment. No Node imports, so browser bundles can use it.\n */\n\nimport { assignOwn } from '../utils/own-property';\nimport {\n  DEFAULT_REDACT_QUERY_PARAMS,\n  SENSITIVE_KEY_NAMES,\n  TRANSPORT_CONFIG_SECRET_NAMES,\n} from '../utils/sensitive-names';\n\nexport const REDACTED = '[REDACTED]';\n\nconst INSPECT_CUSTOM = Symbol.for('nodejs.util.inspect.custom');\nconst MAX_DEPTH = 4;\nconst MIN_SECRET_LENGTH = 4;\nconst SCHEME_PREFIX = /^[a-z][a-z0-9+.-]*:\\/\\//i;\n/** `scheme://userinfo@`: userinfo runs to the LAST `@` before the path, so `p@ss` is covered. */\nconst USERINFO = /(\\b[a-z][a-z0-9+.-]*:\\/\\/)[^\\s/?#]*@/gi;\n\nfunction normalizeName(name: string): string {\n  return name.toLowerCase().replaceAll('-', '').replaceAll('_', '');\n}\n\nconst SECRET_NAMES = [...SENSITIVE_KEY_NAMES, ...TRANSPORT_CONFIG_SECRET_NAMES].map(normalizeName);\nconst QUERY_NAMES = new Set(DEFAULT_REDACT_QUERY_PARAMS.map(normalizeName));\n\n/** Exact match for short names (`key`, `pfx`), suffix match for longer ones (`azureClientSecret`). */\nfunction isSecretKey(key: string): boolean {\n  const name = normalizeName(key);\n  return SECRET_NAMES.some((n) => name === n || (n.length >= 5 && name.endsWith(n)));\n}\n\nfunction isUrlKey(key: string): boolean {\n  return /url|uri|endpoint|href/i.test(key);\n}\n\nfunction isPlainObject(value: object): boolean {\n  const proto = Object.getPrototypeOf(value) as unknown;\n  return proto === Object.prototype || proto === null;\n}\n\nfunction safeDecode(value: string): string {\n  try {\n    return decodeURIComponent(value.replaceAll('+', ' '));\n  } catch {\n    return value;\n  }\n}\n\n/** Absolute URL: `scheme://host` only. Relative or unparseable: path kept, query and fragment cut. */\nexport function redactUrl(raw: string | URL): string {\n  if (typeof raw !== 'string') return `${raw.protocol}//${raw.host}`;\n  if (SCHEME_PREFIX.test(raw)) {\n    try {\n      const url = new URL(raw);\n      return `${url.protocol}//${url.host}`;\n    } catch {\n      return REDACTED;\n    }\n  }\n  return raw.split(/[?#]/, 1)[0] ?? '';\n}\n\nfunction redactHeaders(headers: unknown): unknown {\n  if (!headers || typeof headers !== 'object') return headers;\n  return Object.fromEntries(Object.keys(headers).map((name) => [name, REDACTED]));\n}\n\n/** Redacted deep copy of a config-like value. Never throws, never returns a secret. */\nexport function redactConfig(value: unknown, depth = 0, key = ''): unknown {\n  if (value === null || value === undefined) return value;\n  if (typeof value === 'string') {\n    return SCHEME_PREFIX.test(value) || isUrlKey(key) ? redactUrl(value) : value;\n  }\n  if (typeof value === 'number' || typeof value === 'boolean') return value;\n  if (typeof value === 'function') return '[Function]';\n  if (typeof value !== 'object') return '[Unserializable]';\n  if (typeof URL !== 'undefined' && value instanceof URL) return redactUrl(value);\n  if (Array.isArray(value)) {\n    return depth >= MAX_DEPTH ? '[Array]' : value.map((v) => redactConfig(v, depth + 1, key));\n  }\n  if (!isPlainObject(value) || depth >= MAX_DEPTH)\n    return `[${value.constructor?.name ?? 'Object'}]`;\n  const out: Record<string, unknown> = {};\n  for (const [name, inner] of Object.entries(value)) {\n    if (isSecretKey(name)) assignOwn(out, name, inner === undefined ? undefined : REDACTED);\n    else if (name.toLowerCase() === 'headers') assignOwn(out, name, redactHeaders(inner));\n    else assignOwn(out, name, redactConfig(inner, depth + 1, name));\n  }\n  return out;\n}\n\n// ── Secret protection ───────────────────────────────────────────────────────\n\nconst hiddenKeys = new WeakMap<object, Set<string>>();\nconst hiddenValues = new WeakMap<object, Map<string, unknown>>();\n\nfunction viewOf(target: object): Record<string, unknown> {\n  const hidden = hiddenKeys.get(target) ?? new Set<string>();\n  const values = hiddenValues.get(target);\n  const view: Record<string, unknown> = { class: target.constructor?.name };\n  for (const key of new Set([...Object.keys(target), ...hidden])) {\n    const inner = hidden.has(key) ? values?.get(key) : (target as Record<string, unknown>)[key];\n    if (isSecretKey(key)) view[key] = inner === undefined ? undefined : REDACTED;\n    else if (key.toLowerCase() === 'headers') view[key] = redactHeaders(inner);\n    else if (\n      inner !== null &&\n      typeof inner === 'object' &&\n      !hidden.has(key) &&\n      !(inner instanceof URL)\n    ) {\n      view[key] = '[Object]';\n    } else if (hidden.has(key) && typeof inner === 'string' && !isUrlKey(key)) {\n      view[key] = REDACTED;\n    } else view[key] = redactConfig(inner, 0, key);\n  }\n  return view;\n}\n\n/**\n * Hides `keys` on `target` (assigned or not yet) and gives it a redacted `toJSON()` /\n * inspect view. Fields stay readable and writable. Safe to call more than once.\n * Throws when the target cannot carry the protection (frozen or sealed), instead of\n * silently leaving the secret enumerable.\n */\nexport function protectSecrets(target: object, keys: readonly string[]): void {\n  if (!Object.isExtensible(target)) {\n    throw new TypeError(\n      `protectSecrets: ${target.constructor?.name ?? 'object'} is not extensible`\n    );\n  }\n  let hidden = hiddenKeys.get(target);\n  let values = hiddenValues.get(target);\n  if (!hidden || !values) {\n    hidden = new Set();\n    values = new Map();\n    hiddenKeys.set(target, hidden);\n    hiddenValues.set(target, values);\n    const view = (): Record<string, unknown> => viewOf(target);\n    Object.defineProperty(target, 'toJSON', { value: view, enumerable: false, configurable: true });\n    Object.defineProperty(target, INSPECT_CUSTOM, {\n      value: view,\n      enumerable: false,\n      configurable: true,\n    });\n  }\n  const store = values;\n  for (const key of keys) {\n    if (hidden.has(key)) continue;\n    const desc = Object.getOwnPropertyDescriptor(target, key);\n    if (desc && !desc.configurable) {\n      throw new TypeError(`protectSecrets: \"${key}\" is not configurable`);\n    }\n    if (desc && 'value' in desc) store.set(key, desc.value);\n    hidden.add(key);\n    Object.defineProperty(target, key, {\n      enumerable: false,\n      configurable: true,\n      get: () => store.get(key),\n      set: (next: unknown) => void store.set(key, next),\n    });\n  }\n}\n\n// ── Scrubbing error text ────────────────────────────────────────────────────\n\n/** The raw, decoded and percent-encoded spellings of a secret. */\nfunction variantsOf(secret: string): string[] {\n  return [secret, safeDecode(secret), encodeURIComponent(secret), encodeURI(secret)];\n}\n\n/** Secret parts of a URL string: the password and the values of sensitive query parameters. */\nexport function urlSecrets(raw: string | URL): string[] {\n  const text = typeof raw === 'string' ? raw : raw.href;\n  const out: string[] = [];\n  const userinfo = new RegExp(USERINFO.source, 'i').exec(text);\n  if (userinfo) {\n    const info = text.slice(userinfo[1]!.length, userinfo.index + userinfo[0].length - 1);\n    const colon = info.indexOf(':');\n    if (colon !== -1) out.push(info.slice(colon + 1));\n  }\n  const queryStart = text.indexOf('?');\n  if (queryStart !== -1) {\n    const query = text.slice(queryStart + 1).split('#', 1)[0] ?? '';\n    for (const pair of query.split('&')) {\n      const eq = pair.indexOf('=');\n      if (eq > 0 && QUERY_NAMES.has(normalizeName(safeDecode(pair.slice(0, eq))))) {\n        out.push(pair.slice(eq + 1));\n      }\n    }\n  }\n  return out.flatMap(variantsOf);\n}\n\n/** Every secret string held in a config-like value: secret-keyed values, header values, URL secrets. */\nexport function collectSecrets(value: unknown, depth = 0, key = ''): string[] {\n  if (typeof value === 'string') {\n    if (isSecretKey(key)) return [value];\n    return SCHEME_PREFIX.test(value) || isUrlKey(key) ? urlSecrets(value) : [];\n  }\n  if (!value || typeof value !== 'object' || depth > MAX_DEPTH) return [];\n  if (typeof URL !== 'undefined' && value instanceof URL) return urlSecrets(value);\n  if (Array.isArray(value)) return value.flatMap((v) => collectSecrets(v, depth + 1, key));\n  if (!isPlainObject(value)) return [];\n  const isHeaders = key.toLowerCase() === 'headers';\n  return Object.entries(value).flatMap(([name, inner]) => {\n    if (isHeaders && typeof inner === 'string') return [inner];\n    if (isSecretKey(name) && inner !== null && typeof inner === 'object') {\n      return collectSecrets(inner, depth + 1, 'secret');\n    }\n    return collectSecrets(inner, depth + 1, name);\n  });\n}\n\n/** Replaces URL userinfo and every spelling of the given secret values in `text`. */\nexport function scrubSecrets(text: string, secrets: readonly (string | undefined)[]): string {\n  let out = text.replace(USERINFO, `$1${REDACTED}@`);\n  const all = new Set(\n    secrets.flatMap((s) => (s && s.length >= MIN_SECRET_LENGTH ? variantsOf(s) : []))\n  );\n  for (const secret of [...all].sort((a, b) => b.length - a.length)) {\n    if (secret.length >= MIN_SECRET_LENGTH) out = out.split(secret).join(REDACTED);\n  }\n  return out;\n}\n\n/** Scrubs message, stack and the cause chain of `err` in place; returns it. */\nexport function scrubError<T>(err: T, secrets: readonly (string | undefined)[], depth = 0): T {\n  if (!(err instanceof Error) || depth > 3) return err;\n  try {\n    err.message = scrubSecrets(err.message, secrets);\n    if (err.stack) err.stack = scrubSecrets(err.stack, secrets);\n    scrubError((err as { cause?: unknown }).cause, secrets, depth + 1);\n  } catch {\n    /* frozen error: leave as is */\n  }\n  return err;\n}\n\n/** A `.catch()` handler that scrubs the secrets from the error, then rethrows it. */\nexport function scrubbing(secrets: () => (string | undefined)[]): (err: unknown) => never {\n  return (err) => {\n    throw scrubError(err, secrets());\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AAkBA,MAAa,WAAW;AAExB,MAAM,iBAAiB,OAAO,IAAI,4BAA4B;AAC9D,MAAM,YAAY;AAClB,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;;AAEtB,MAAM,WAAW;AAEjB,SAAS,cAAc,MAAsB;CAC3C,OAAO,KAAK,YAAY,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,WAAW,KAAK,EAAE;AAClE;AAEA,MAAM,eAAe,CAAC,GAAG,qBAAqB,GAAG,6BAA6B,CAAC,CAAC,IAAI,aAAa;AACjG,MAAM,cAAc,IAAI,IAAI,4BAA4B,IAAI,aAAa,CAAC;;AAG1E,SAAS,YAAY,KAAsB;CACzC,MAAM,OAAO,cAAc,GAAG;CAC9B,OAAO,aAAa,MAAM,MAAM,SAAS,KAAM,EAAE,UAAU,KAAK,KAAK,SAAS,CAAC,CAAE;AACnF;AAEA,SAAS,SAAS,KAAsB;CACtC,OAAO,yBAAyB,KAAK,GAAG;AAC1C;AAEA,SAAS,cAAc,OAAwB;CAC7C,MAAM,QAAQ,OAAO,eAAe,KAAK;CACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,SAAS,WAAW,OAAuB;CACzC,IAAI;EACF,OAAO,mBAAmB,MAAM,WAAW,KAAK,GAAG,CAAC;CACtD,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,UAAU,KAA2B;CACnD,IAAI,OAAO,QAAQ,UAAU,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CAC5D,IAAI,cAAc,KAAK,GAAG,GACxB,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,GAAG;EACvB,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN,OAAO;CACT;CAEF,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,MAAM;AACpC;AAEA,SAAS,cAAc,SAA2B;CAChD,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU,OAAO;CACpD,OAAO,OAAO,YAAY,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,QAAQ,CAAC,CAAC;AAChF;;AAGA,SAAgB,aAAa,OAAgB,QAAQ,GAAG,MAAM,IAAa;;CACzE,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,OAAO;CAClD,IAAI,OAAO,UAAU,UACnB,OAAO,cAAc,KAAK,KAAK,KAAK,SAAS,GAAG,IAAI,UAAU,KAAK,IAAI;CAEzE,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW,OAAO;CACpE,IAAI,OAAO,UAAU,YAAY,OAAO;CACxC,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,OAAO,QAAQ,eAAe,iBAAiB,KAAK,OAAO,UAAU,KAAK;CAC9E,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,SAAS,YAAY,YAAY,MAAM,KAAK,MAAM,aAAa,GAAG,QAAQ,GAAG,GAAG,CAAC;CAE1F,IAAI,CAAC,cAAc,KAAK,KAAK,SAAS,WACpC,OAAO,MAAA,qBAAI,MAAM,iBAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAa,SAAQ,SAAS;CACjD,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,GAC9C,IAAI,YAAY,IAAI,GAAG,UAAU,KAAK,MAAM,UAAU,KAAA,IAAY,KAAA,IAAY,QAAQ;MACjF,IAAI,KAAK,YAAY,MAAM,WAAW,UAAU,KAAK,MAAM,cAAc,KAAK,CAAC;MAC/E,UAAU,KAAK,MAAM,aAAa,OAAO,QAAQ,GAAG,IAAI,CAAC;CAEhE,OAAO;AACT;AAIA,MAAM,6BAAa,IAAI,QAA6B;AACpD,MAAM,+BAAe,IAAI,QAAsC;AAE/D,SAAS,OAAO,QAAyC;;CACvD,MAAM,SAAS,WAAW,IAAI,MAAM,qBAAK,IAAI,IAAY;CACzD,MAAM,SAAS,aAAa,IAAI,MAAM;CACtC,MAAM,OAAgC,EAAE,QAAA,sBAAO,OAAO,iBAAA,QAAA,wBAAA,KAAA,IAAA,KAAA,IAAA,oBAAa,KAAK;CACxE,KAAK,MAAM,uBAAO,IAAI,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;EAC9D,MAAM,QAAQ,OAAO,IAAI,GAAG,IAAA,WAAA,QAAA,WAAA,KAAA,IAAA,KAAA,IAAI,OAAQ,IAAI,GAAG,IAAK,OAAmC;EACvF,IAAI,YAAY,GAAG,GAAG,KAAK,OAAO,UAAU,KAAA,IAAY,KAAA,IAAY;OAC/D,IAAI,IAAI,YAAY,MAAM,WAAW,KAAK,OAAO,cAAc,KAAK;OACpE,IACH,UAAU,QACV,OAAO,UAAU,YACjB,CAAC,OAAO,IAAI,GAAG,KACf,EAAE,iBAAiB,MAEnB,KAAK,OAAO;OACP,IAAI,OAAO,IAAI,GAAG,KAAK,OAAO,UAAU,YAAY,CAAC,SAAS,GAAG,GACtE,KAAK,OAAO;OACP,KAAK,OAAO,aAAa,OAAO,GAAG,GAAG;CAC/C;CACA,OAAO;AACT;;;;;;;AAQA,SAAgB,eAAe,QAAgB,MAA+B;CAC5E,IAAI,CAAC,OAAO,aAAa,MAAM,GAAG;;EAChC,MAAM,IAAI,UACR,qBAAA,uBAAmB,OAAO,iBAAA,QAAA,yBAAA,KAAA,IAAA,KAAA,IAAA,qBAAa,SAAQ,SAAS,mBAC1D;CACF;CACA,IAAI,SAAS,WAAW,IAAI,MAAM;CAClC,IAAI,SAAS,aAAa,IAAI,MAAM;CACpC,IAAI,CAAC,UAAU,CAAC,QAAQ;EACtB,yBAAS,IAAI,IAAI;EACjB,yBAAS,IAAI,IAAI;EACjB,WAAW,IAAI,QAAQ,MAAM;EAC7B,aAAa,IAAI,QAAQ,MAAM;EAC/B,MAAM,aAAsC,OAAO,MAAM;EACzD,OAAO,eAAe,QAAQ,UAAU;GAAE,OAAO;GAAM,YAAY;GAAO,cAAc;EAAK,CAAC;EAC9F,OAAO,eAAe,QAAQ,gBAAgB;GAC5C,OAAO;GACP,YAAY;GACZ,cAAc;EAChB,CAAC;CACH;CACA,MAAM,QAAQ;CACd,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,OAAO,IAAI,GAAG,GAAG;EACrB,MAAM,OAAO,OAAO,yBAAyB,QAAQ,GAAG;EACxD,IAAI,QAAQ,CAAC,KAAK,cAChB,MAAM,IAAI,UAAU,oBAAoB,IAAI,sBAAsB;EAEpE,IAAI,QAAQ,WAAW,MAAM,MAAM,IAAI,KAAK,KAAK,KAAK;EACtD,OAAO,IAAI,GAAG;EACd,OAAO,eAAe,QAAQ,KAAK;GACjC,YAAY;GACZ,cAAc;GACd,WAAW,MAAM,IAAI,GAAG;GACxB,MAAM,SAAkB,KAAK,MAAM,IAAI,KAAK,IAAI;EAClD,CAAC;CACH;AACF;;AAKA,SAAS,WAAW,QAA0B;CAC5C,OAAO;EAAC;EAAQ,WAAW,MAAM;EAAG,mBAAmB,MAAM;EAAG,UAAU,MAAM;CAAC;AACnF;;AAGA,SAAgB,WAAW,KAA6B;CACtD,MAAM,OAAO,OAAO,QAAQ,WAAW,MAAM,IAAI;CACjD,MAAM,MAAgB,CAAC;CACvB,MAAM,WAAW,IAAI,OAAO,SAAS,QAAQ,GAAG,CAAC,CAAC,KAAK,IAAI;CAC3D,IAAI,UAAU;EACZ,MAAM,OAAO,KAAK,MAAM,SAAS,EAAE,CAAE,QAAQ,SAAS,QAAQ,SAAS,EAAE,CAAC,SAAS,CAAC;EACpF,MAAM,QAAQ,KAAK,QAAQ,GAAG;EAC9B,IAAI,UAAU,IAAI,IAAI,KAAK,KAAK,MAAM,QAAQ,CAAC,CAAC;CAClD;CACA,MAAM,aAAa,KAAK,QAAQ,GAAG;CACnC,IAAI,eAAe,IAAI;EACrB,MAAM,QAAQ,KAAK,MAAM,aAAa,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM;EAC7D,KAAK,MAAM,QAAQ,MAAM,MAAM,GAAG,GAAG;GACnC,MAAM,KAAK,KAAK,QAAQ,GAAG;GAC3B,IAAI,KAAK,KAAK,YAAY,IAAI,cAAc,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GACxE,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC;EAE/B;CACF;CACA,OAAO,IAAI,QAAQ,UAAU;AAC/B;;AAGA,SAAgB,eAAe,OAAgB,QAAQ,GAAG,MAAM,IAAc;CAC5E,IAAI,OAAO,UAAU,UAAU;EAC7B,IAAI,YAAY,GAAG,GAAG,OAAO,CAAC,KAAK;EACnC,OAAO,cAAc,KAAK,KAAK,KAAK,SAAS,GAAG,IAAI,WAAW,KAAK,IAAI,CAAC;CAC3E;CACA,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,QAAQ,WAAW,OAAO,CAAC;CACtE,IAAI,OAAO,QAAQ,eAAe,iBAAiB,KAAK,OAAO,WAAW,KAAK;CAC/E,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,SAAS,MAAM,eAAe,GAAG,QAAQ,GAAG,GAAG,CAAC;CACvF,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,CAAC;CACnC,MAAM,YAAY,IAAI,YAAY,MAAM;CACxC,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,WAAW;EACtD,IAAI,aAAa,OAAO,UAAU,UAAU,OAAO,CAAC,KAAK;EACzD,IAAI,YAAY,IAAI,KAAK,UAAU,QAAQ,OAAO,UAAU,UAC1D,OAAO,eAAe,OAAO,QAAQ,GAAG,QAAQ;EAElD,OAAO,eAAe,OAAO,QAAQ,GAAG,IAAI;CAC9C,CAAC;AACH;;AAGA,SAAgB,aAAa,MAAc,SAAkD;CAC3F,IAAI,MAAM,KAAK,QAAQ,UAAU,KAAK,SAAS,EAAE;CACjD,MAAM,MAAM,IAAI,IACd,QAAQ,SAAS,MAAO,KAAK,EAAE,UAAU,oBAAoB,WAAW,CAAC,IAAI,CAAC,CAAE,CAClF;CACA,KAAK,MAAM,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAC9D,IAAI,OAAO,UAAU,mBAAmB,MAAM,IAAI,MAAM,MAAM,CAAC,CAAC,KAAK,QAAQ;CAE/E,OAAO;AACT;;AAGA,SAAgB,WAAc,KAAQ,SAA0C,QAAQ,GAAM;CAC5F,IAAI,EAAE,eAAe,UAAU,QAAQ,GAAG,OAAO;CACjD,IAAI;EACF,IAAI,UAAU,aAAa,IAAI,SAAS,OAAO;EAC/C,IAAI,IAAI,OAAO,IAAI,QAAQ,aAAa,IAAI,OAAO,OAAO;EAC1D,WAAY,IAA4B,OAAO,SAAS,QAAQ,CAAC;CACnE,QAAQ,CAER;CACA,OAAO;AACT;;AAGA,SAAgB,UAAU,SAAgE;CACxF,QAAQ,QAAQ;EACd,MAAM,WAAW,KAAK,QAAQ,CAAC;CACjC;AACF"}

package/dist/{sensitive-names-o__1PUUR.mjs → sensitive-names-BiBM6R1X.mjs}

@@ -1,29 +1,3 @@
-// src/utils/own-property.ts
-/**
-* True for the one key that must never be assigned with `target[key] = value`.
-*
-* Assigning `constructor` or `prototype` on a fresh plain object only creates an
-* own property, which is harmless. Only `__proto__` invokes the prototype setter.
-*/
-function isProtoKey(key) {
-	return key === "__proto__";
-}
-/**
-* Copy `value` onto `target[key]` as an own, enumerable data property.
-*
-* Normal keys use a plain assignment, which is the fast path. `__proto__` goes
-* through `Object.defineProperty` so that a key taken from logged or parsed data
-* becomes an own property instead of replacing the object's prototype.
-*/
-function assignOwn(target, key, value) {
-	if (key === "__proto__") Object.defineProperty(target, key, {
-		value,
-		enumerable: true,
-		writable: true,
-		configurable: true
-	});
-	else target[key] = value;
-}
 // src/utils/sensitive-names.ts
 /**
 * The one list of sensitive names. Log redaction (redact.utils), the HTTP logger
@@ -212,6 +186,6 @@ function redactUrlsInText(text, names) {
 function sanitizeText(text, names, values) {
 	return scrubValues(redactUrlsInText(text, names), values);
 }
-export { buildNameSet as a, sensitiveQueryValues as c, TRANSPORT_CONFIG_SECRET_NAMES as i, assignOwn as l, DEFAULT_REDACT_QUERY_PARAMS as n, redactUrlQuery as o, SENSITIVE_KEY_NAMES as r, sanitizeText as s, DEFAULT_REDACT_HEADERS as t, isProtoKey as u };
+export { buildNameSet as a, sanitizeText as c, TRANSPORT_CONFIG_SECRET_NAMES as i, sensitiveQueryValues as l, DEFAULT_REDACT_QUERY_PARAMS as n, redactUrlQuery as o, SENSITIVE_KEY_NAMES as r, redactUrlsInText as s, DEFAULT_REDACT_HEADERS as t };
 
-//# sourceMappingURL=sensitive-names-o__1PUUR.mjs.map
+//# sourceMappingURL=sensitive-names-BiBM6R1X.mjs.map

package/dist/sensitive-names-BiBM6R1X.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-names-BiBM6R1X.mjs","names":[],"sources":["../src/utils/sensitive-names.ts"],"sourcesContent":["/**\n * The one list of sensitive names. Log redaction (redact.utils), the HTTP logger\n * middleware and transport secret handling (transports/secret-config) all read it,\n * so the lists cannot drift. No imports: safe from any module, including browser code.\n */\n\n/** Field names redacted by name, wherever they appear in logged data. */\nexport const SENSITIVE_KEY_NAMES: readonly string[] = [\n  'password',\n  'passwd',\n  'secret',\n  'token',\n  'apiKey',\n  'api_key',\n  'accessToken',\n  'access_token',\n  'refreshToken',\n  'refresh_token',\n  'authorization',\n  'credentials',\n  'privateKey',\n  'private_key',\n  'clientSecret',\n  'client_secret',\n  'cookie',\n  'set-cookie',\n  'x-api-key',\n  'session',\n  'proxy-authorization',\n  'x-auth-token',\n  'x-access-token',\n  'aws_secret_access_key',\n  'awsSecretAccessKey',\n  'secretAccessKey',\n];\n\n/**\n * Extra names that only mean \"secret\" inside transport configuration, where\n * short words like `key` or `signature` are credentials, not log fields.\n */\nexport const TRANSPORT_CONFIG_SECRET_NAMES: readonly string[] = [\n  'writeKey',\n  'apiSecret',\n  'connectionString',\n  'sessionToken',\n  'passphrase',\n  'signature',\n  'pwd',\n  'pfx',\n  'cert',\n  'key',\n  'auth',\n];\n\n/** Request headers whose values are never logged. */\nexport const DEFAULT_REDACT_HEADERS: readonly string[] = [\n  'authorization',\n  'cookie',\n  'set-cookie',\n  'x-api-key',\n  'proxy-authorization',\n  'x-auth-token',\n  'x-access-token',\n  'x-csrf-token',\n  'x-amz-security-token',\n];\n\n/** Query-string parameters whose values are never logged. */\nexport const DEFAULT_REDACT_QUERY_PARAMS: readonly string[] = [\n  'token',\n  'access_token',\n  'refresh_token',\n  'code',\n  'password',\n  'secret',\n  'api_key',\n  'apikey',\n  'key',\n  'signature',\n  'sig',\n  'auth',\n  'accesstoken',\n  'refreshtoken',\n  'id_token',\n  'idtoken',\n  'client_secret',\n  'clientsecret',\n  'session',\n  'sessionid',\n  'session_id',\n  'jwt',\n  'auth_token',\n  'authtoken',\n  'api-key',\n  'x-api-key',\n  'x-amz-signature',\n  'x-amz-credential',\n  'x-amz-security-token',\n  'x-goog-signature',\n  'x-goog-credential',\n  'access-token',\n  'x-access-token',\n  'x-auth-token',\n  'apitoken',\n  'api_token',\n];\n\nfunction safeDecode(value: string): string {\n  try {\n    return decodeURIComponent(value.replace(/\\+/g, ' '));\n  } catch {\n    return value;\n  }\n}\n\n/** Replace the values of sensitive query parameters, leaving the rest verbatim. */\nexport function redactUrlQuery(url: string, redactParams: ReadonlySet<string>): string {\n  const q = url.indexOf('?');\n  if (q === -1) return url;\n  const hashAt = url.indexOf('#', q);\n  const query = url.slice(q + 1, hashAt === -1 ? undefined : hashAt);\n  const hash = hashAt === -1 ? '' : url.slice(hashAt);\n  const cleaned = query\n    .split('&')\n    .map((pair) => {\n      const eq = pair.indexOf('=');\n      const rawKey = eq === -1 ? pair : pair.slice(0, eq);\n      const decoded = safeDecode(rawKey);\n      const bracket = decoded.indexOf('[');\n      const name = (bracket === -1 ? decoded : decoded.slice(0, bracket)).toLowerCase();\n      return redactParams.has(name) && eq !== -1 ? `${rawKey}=[REDACTED]` : pair;\n    })\n    .join('&');\n  return `${url.slice(0, q)}?${cleaned}${hash}`;\n}\n\n/** Lower-cased lookup set of the default names plus any extras. */\nexport function buildNameSet(\n  defaults: readonly string[],\n  extra: readonly string[] | undefined\n): Set<string> {\n  return new Set([...defaults, ...(extra ?? [])].map((n) => n.toLowerCase()));\n}\n\nconst REDACTED = '[REDACTED]';\nconst MIN_SCRUB_LENGTH = 3;\n\nfunction queryNameOf(rawKey: string): string {\n  const decoded = safeDecode(rawKey);\n  const bracket = decoded.indexOf('[');\n  return (bracket === -1 ? decoded : decoded.slice(0, bracket)).toLowerCase();\n}\n\n/**\n * Raw and decoded values of sensitive query parameters present in this URL.\n * Values shorter than 3 characters or already `[REDACTED]` are ignored.\n */\nexport function sensitiveQueryValues(url: string, names: ReadonlySet<string>): string[] {\n  const q = url.indexOf('?');\n  if (q === -1) return [];\n  const hashAt = url.indexOf('#', q);\n  const query = url.slice(q + 1, hashAt === -1 ? undefined : hashAt);\n  const found = new Set<string>();\n  for (const pair of query.split('&')) {\n    const eq = pair.indexOf('=');\n    if (eq === -1 || !names.has(queryNameOf(pair.slice(0, eq)))) continue;\n    const raw = pair.slice(eq + 1);\n    for (const value of [raw, safeDecode(raw)]) {\n      if (value.length >= MIN_SCRUB_LENGTH && value !== REDACTED) found.add(value);\n    }\n  }\n  return [...found];\n}\n\n/** Replace every literal occurrence of `values` in `text` with `[REDACTED]`. */\nexport function scrubValues(text: string, values: readonly string[]): string {\n  if (values.length === 0 || text.length === 0) return text;\n  let out = text;\n  for (const value of [...values].sort((a, b) => b.length - a.length)) {\n    if (value.length > 0 && out.includes(value)) out = out.split(value).join(REDACTED);\n  }\n  return out;\n}\n\nfunction isUrlTerminator(ch: string): boolean {\n  return (\n    ch === ' ' ||\n    ch === '\\n' ||\n    ch === '\\r' ||\n    ch === '\\t' ||\n    ch === '\"' ||\n    ch === \"'\" ||\n    ch === '`'\n  );\n}\n\n/**\n * Redact sensitive query values in every `?query` found inside free text (an\n * error message, a stack line). Scans for `?` and cuts at whitespace or a quote.\n */\nexport function redactUrlsInText(text: string, names: ReadonlySet<string>): string {\n  let q = text.indexOf('?');\n  if (q === -1) return text;\n  let out = '';\n  let cursor = 0;\n  while (q !== -1) {\n    let end = q + 1;\n    while (end < text.length && !isUrlTerminator(text.charAt(end))) end++;\n    out += text.slice(cursor, q) + redactUrlQuery(text.slice(q, end), names);\n    cursor = end;\n    q = text.indexOf('?', end);\n  }\n  return out + text.slice(cursor);\n}\n\n/** Shape-preserving URL redaction plus literal scrubbing of this request's secret values. */\nexport function sanitizeText(\n  text: string,\n  names: ReadonlySet<string>,\n  values: readonly string[]\n): string {\n  return scrubValues(redactUrlsInText(text, names), values);\n}\n"],"mappings":";;;;;;;AAOA,MAAa,sBAAyC;CACpD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AAMA,MAAa,gCAAmD;CAC9D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,MAAa,yBAA4C;CACvD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,MAAa,8BAAiD;CAC5D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,SAAS,WAAW,OAAuB;CACzC,IAAI;EACF,OAAO,mBAAmB,MAAM,QAAQ,OAAO,GAAG,CAAC;CACrD,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,eAAe,KAAa,cAA2C;CACrF,MAAM,IAAI,IAAI,QAAQ,GAAG;CACzB,IAAI,MAAM,IAAI,OAAO;CACrB,MAAM,SAAS,IAAI,QAAQ,KAAK,CAAC;CACjC,MAAM,QAAQ,IAAI,MAAM,IAAI,GAAG,WAAW,KAAK,KAAA,IAAY,MAAM;CACjE,MAAM,OAAO,WAAW,KAAK,KAAK,IAAI,MAAM,MAAM;CAClD,MAAM,UAAU,MACb,MAAM,GAAG,CAAC,CACV,KAAK,SAAS;EACb,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,MAAM,SAAS,OAAO,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE;EAClD,MAAM,UAAU,WAAW,MAAM;EACjC,MAAM,UAAU,QAAQ,QAAQ,GAAG;EACnC,MAAM,QAAQ,YAAY,KAAK,UAAU,QAAQ,MAAM,GAAG,OAAO,EAAA,CAAG,YAAY;EAChF,OAAO,aAAa,IAAI,IAAI,KAAK,OAAO,KAAK,GAAG,OAAO,eAAe;CACxE,CAAC,CAAC,CACD,KAAK,GAAG;CACX,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,UAAU;AACzC;;AAGA,SAAgB,aACd,UACA,OACa;CACb,OAAO,IAAI,IAAI,CAAC,GAAG,UAAU,GAAI,SAAS,CAAC,CAAE,CAAC,CAAC,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC;AAC5E;AAEA,MAAM,WAAW;AACjB,MAAM,mBAAmB;AAEzB,SAAS,YAAY,QAAwB;CAC3C,MAAM,UAAU,WAAW,MAAM;CACjC,MAAM,UAAU,QAAQ,QAAQ,GAAG;CACnC,QAAQ,YAAY,KAAK,UAAU,QAAQ,MAAM,GAAG,OAAO,EAAA,CAAG,YAAY;AAC5E;;;;;AAMA,SAAgB,qBAAqB,KAAa,OAAsC;CACtF,MAAM,IAAI,IAAI,QAAQ,GAAG;CACzB,IAAI,MAAM,IAAI,OAAO,CAAC;CACtB,MAAM,SAAS,IAAI,QAAQ,KAAK,CAAC;CACjC,MAAM,QAAQ,IAAI,MAAM,IAAI,GAAG,WAAW,KAAK,KAAA,IAAY,MAAM;CACjE,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,QAAQ,MAAM,MAAM,GAAG,GAAG;EACnC,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,OAAO,MAAM,CAAC,MAAM,IAAI,YAAY,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,GAAG;EAC7D,MAAM,MAAM,KAAK,MAAM,KAAK,CAAC;EAC7B,KAAK,MAAM,SAAS,CAAC,KAAK,WAAW,GAAG,CAAC,GACvC,IAAI,MAAM,UAAU,oBAAoB,UAAU,UAAU,MAAM,IAAI,KAAK;CAE/E;CACA,OAAO,CAAC,GAAG,KAAK;AAClB;;AAGA,SAAgB,YAAY,MAAc,QAAmC;CAC3E,IAAI,OAAO,WAAW,KAAK,KAAK,WAAW,GAAG,OAAO;CACrD,IAAI,MAAM;CACV,KAAK,MAAM,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAChE,IAAI,MAAM,SAAS,KAAK,IAAI,SAAS,KAAK,GAAG,MAAM,IAAI,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ;CAEnF,OAAO;AACT;AAEA,SAAS,gBAAgB,IAAqB;CAC5C,OACE,OAAO,OACP,OAAO,QACP,OAAO,QACP,OAAO,OACP,OAAO,QACP,OAAO,OACP,OAAO;AAEX;;;;;AAMA,SAAgB,iBAAiB,MAAc,OAAoC;CACjF,IAAI,IAAI,KAAK,QAAQ,GAAG;CACxB,IAAI,MAAM,IAAI,OAAO;CACrB,IAAI,MAAM;CACV,IAAI,SAAS;CACb,OAAO,MAAM,IAAI;EACf,IAAI,MAAM,IAAI;EACd,OAAO,MAAM,KAAK,UAAU,CAAC,gBAAgB,KAAK,OAAO,GAAG,CAAC,GAAG;EAChE,OAAO,KAAK,MAAM,QAAQ,CAAC,IAAI,eAAe,KAAK,MAAM,GAAG,GAAG,GAAG,KAAK;EACvE,SAAS;EACT,IAAI,KAAK,QAAQ,KAAK,GAAG;CAC3B;CACA,OAAO,MAAM,KAAK,MAAM,MAAM;AAChC;;AAGA,SAAgB,aACd,MACA,OACA,QACQ;CACR,OAAO,YAAY,iBAAiB,MAAM,KAAK,GAAG,MAAM;AAC1D"}

package/dist/{sensitive-names-CHMowujD.js → sensitive-names-NiKIRhp5.js}

@@ -1,29 +1,3 @@
-// src/utils/own-property.ts
-/**
-* True for the one key that must never be assigned with `target[key] = value`.
-*
-* Assigning `constructor` or `prototype` on a fresh plain object only creates an
-* own property, which is harmless. Only `__proto__` invokes the prototype setter.
-*/
-function isProtoKey(key) {
-	return key === "__proto__";
-}
-/**
-* Copy `value` onto `target[key]` as an own, enumerable data property.
-*
-* Normal keys use a plain assignment, which is the fast path. `__proto__` goes
-* through `Object.defineProperty` so that a key taken from logged or parsed data
-* becomes an own property instead of replacing the object's prototype.
-*/
-function assignOwn(target, key, value) {
-	if (key === "__proto__") Object.defineProperty(target, key, {
-		value,
-		enumerable: true,
-		writable: true,
-		configurable: true
-	});
-	else target[key] = value;
-}
 // src/utils/sensitive-names.ts
 /**
 * The one list of sensitive names. Log redaction (redact.utils), the HTTP logger
@@ -236,28 +210,22 @@ Object.defineProperty(exports, "TRANSPORT_CONFIG_SECRET_NAMES", {
 		return TRANSPORT_CONFIG_SECRET_NAMES;
 	}
 });
-Object.defineProperty(exports, "assignOwn", {
-	enumerable: true,
-	get: function() {
-		return assignOwn;
-	}
-});
 Object.defineProperty(exports, "buildNameSet", {
 	enumerable: true,
 	get: function() {
 		return buildNameSet;
 	}
 });
-Object.defineProperty(exports, "isProtoKey", {
+Object.defineProperty(exports, "redactUrlQuery", {
 	enumerable: true,
 	get: function() {
-		return isProtoKey;
+		return redactUrlQuery;
 	}
 });
-Object.defineProperty(exports, "redactUrlQuery", {
+Object.defineProperty(exports, "redactUrlsInText", {
 	enumerable: true,
 	get: function() {
-		return redactUrlQuery;
+		return redactUrlsInText;
 	}
 });
 Object.defineProperty(exports, "sanitizeText", {
@@ -273,4 +241,4 @@ Object.defineProperty(exports, "sensitiveQueryValues", {
 	}
 });
 
-//# sourceMappingURL=sensitive-names-CHMowujD.js.map
+//# sourceMappingURL=sensitive-names-NiKIRhp5.js.map

package/dist/sensitive-names-NiKIRhp5.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-names-NiKIRhp5.js","names":[],"sources":["../src/utils/sensitive-names.ts"],"sourcesContent":["/**\n * The one list of sensitive names. Log redaction (redact.utils), the HTTP logger\n * middleware and transport secret handling (transports/secret-config) all read it,\n * so the lists cannot drift. No imports: safe from any module, including browser code.\n */\n\n/** Field names redacted by name, wherever they appear in logged data. */\nexport const SENSITIVE_KEY_NAMES: readonly string[] = [\n  'password',\n  'passwd',\n  'secret',\n  'token',\n  'apiKey',\n  'api_key',\n  'accessToken',\n  'access_token',\n  'refreshToken',\n  'refresh_token',\n  'authorization',\n  'credentials',\n  'privateKey',\n  'private_key',\n  'clientSecret',\n  'client_secret',\n  'cookie',\n  'set-cookie',\n  'x-api-key',\n  'session',\n  'proxy-authorization',\n  'x-auth-token',\n  'x-access-token',\n  'aws_secret_access_key',\n  'awsSecretAccessKey',\n  'secretAccessKey',\n];\n\n/**\n * Extra names that only mean \"secret\" inside transport configuration, where\n * short words like `key` or `signature` are credentials, not log fields.\n */\nexport const TRANSPORT_CONFIG_SECRET_NAMES: readonly string[] = [\n  'writeKey',\n  'apiSecret',\n  'connectionString',\n  'sessionToken',\n  'passphrase',\n  'signature',\n  'pwd',\n  'pfx',\n  'cert',\n  'key',\n  'auth',\n];\n\n/** Request headers whose values are never logged. */\nexport const DEFAULT_REDACT_HEADERS: readonly string[] = [\n  'authorization',\n  'cookie',\n  'set-cookie',\n  'x-api-key',\n  'proxy-authorization',\n  'x-auth-token',\n  'x-access-token',\n  'x-csrf-token',\n  'x-amz-security-token',\n];\n\n/** Query-string parameters whose values are never logged. */\nexport const DEFAULT_REDACT_QUERY_PARAMS: readonly string[] = [\n  'token',\n  'access_token',\n  'refresh_token',\n  'code',\n  'password',\n  'secret',\n  'api_key',\n  'apikey',\n  'key',\n  'signature',\n  'sig',\n  'auth',\n  'accesstoken',\n  'refreshtoken',\n  'id_token',\n  'idtoken',\n  'client_secret',\n  'clientsecret',\n  'session',\n  'sessionid',\n  'session_id',\n  'jwt',\n  'auth_token',\n  'authtoken',\n  'api-key',\n  'x-api-key',\n  'x-amz-signature',\n  'x-amz-credential',\n  'x-amz-security-token',\n  'x-goog-signature',\n  'x-goog-credential',\n  'access-token',\n  'x-access-token',\n  'x-auth-token',\n  'apitoken',\n  'api_token',\n];\n\nfunction safeDecode(value: string): string {\n  try {\n    return decodeURIComponent(value.replace(/\\+/g, ' '));\n  } catch {\n    return value;\n  }\n}\n\n/** Replace the values of sensitive query parameters, leaving the rest verbatim. */\nexport function redactUrlQuery(url: string, redactParams: ReadonlySet<string>): string {\n  const q = url.indexOf('?');\n  if (q === -1) return url;\n  const hashAt = url.indexOf('#', q);\n  const query = url.slice(q + 1, hashAt === -1 ? undefined : hashAt);\n  const hash = hashAt === -1 ? '' : url.slice(hashAt);\n  const cleaned = query\n    .split('&')\n    .map((pair) => {\n      const eq = pair.indexOf('=');\n      const rawKey = eq === -1 ? pair : pair.slice(0, eq);\n      const decoded = safeDecode(rawKey);\n      const bracket = decoded.indexOf('[');\n      const name = (bracket === -1 ? decoded : decoded.slice(0, bracket)).toLowerCase();\n      return redactParams.has(name) && eq !== -1 ? `${rawKey}=[REDACTED]` : pair;\n    })\n    .join('&');\n  return `${url.slice(0, q)}?${cleaned}${hash}`;\n}\n\n/** Lower-cased lookup set of the default names plus any extras. */\nexport function buildNameSet(\n  defaults: readonly string[],\n  extra: readonly string[] | undefined\n): Set<string> {\n  return new Set([...defaults, ...(extra ?? [])].map((n) => n.toLowerCase()));\n}\n\nconst REDACTED = '[REDACTED]';\nconst MIN_SCRUB_LENGTH = 3;\n\nfunction queryNameOf(rawKey: string): string {\n  const decoded = safeDecode(rawKey);\n  const bracket = decoded.indexOf('[');\n  return (bracket === -1 ? decoded : decoded.slice(0, bracket)).toLowerCase();\n}\n\n/**\n * Raw and decoded values of sensitive query parameters present in this URL.\n * Values shorter than 3 characters or already `[REDACTED]` are ignored.\n */\nexport function sensitiveQueryValues(url: string, names: ReadonlySet<string>): string[] {\n  const q = url.indexOf('?');\n  if (q === -1) return [];\n  const hashAt = url.indexOf('#', q);\n  const query = url.slice(q + 1, hashAt === -1 ? undefined : hashAt);\n  const found = new Set<string>();\n  for (const pair of query.split('&')) {\n    const eq = pair.indexOf('=');\n    if (eq === -1 || !names.has(queryNameOf(pair.slice(0, eq)))) continue;\n    const raw = pair.slice(eq + 1);\n    for (const value of [raw, safeDecode(raw)]) {\n      if (value.length >= MIN_SCRUB_LENGTH && value !== REDACTED) found.add(value);\n    }\n  }\n  return [...found];\n}\n\n/** Replace every literal occurrence of `values` in `text` with `[REDACTED]`. */\nexport function scrubValues(text: string, values: readonly string[]): string {\n  if (values.length === 0 || text.length === 0) return text;\n  let out = text;\n  for (const value of [...values].sort((a, b) => b.length - a.length)) {\n    if (value.length > 0 && out.includes(value)) out = out.split(value).join(REDACTED);\n  }\n  return out;\n}\n\nfunction isUrlTerminator(ch: string): boolean {\n  return (\n    ch === ' ' ||\n    ch === '\\n' ||\n    ch === '\\r' ||\n    ch === '\\t' ||\n    ch === '\"' ||\n    ch === \"'\" ||\n    ch === '`'\n  );\n}\n\n/**\n * Redact sensitive query values in every `?query` found inside free text (an\n * error message, a stack line). Scans for `?` and cuts at whitespace or a quote.\n */\nexport function redactUrlsInText(text: string, names: ReadonlySet<string>): string {\n  let q = text.indexOf('?');\n  if (q === -1) return text;\n  let out = '';\n  let cursor = 0;\n  while (q !== -1) {\n    let end = q + 1;\n    while (end < text.length && !isUrlTerminator(text.charAt(end))) end++;\n    out += text.slice(cursor, q) + redactUrlQuery(text.slice(q, end), names);\n    cursor = end;\n    q = text.indexOf('?', end);\n  }\n  return out + text.slice(cursor);\n}\n\n/** Shape-preserving URL redaction plus literal scrubbing of this request's secret values. */\nexport function sanitizeText(\n  text: string,\n  names: ReadonlySet<string>,\n  values: readonly string[]\n): string {\n  return scrubValues(redactUrlsInText(text, names), values);\n}\n"],"mappings":";;;;;;;AAOA,MAAa,sBAAyC;CACpD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AAMA,MAAa,gCAAmD;CAC9D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,MAAa,yBAA4C;CACvD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,MAAa,8BAAiD;CAC5D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,SAAS,WAAW,OAAuB;CACzC,IAAI;EACF,OAAO,mBAAmB,MAAM,QAAQ,OAAO,GAAG,CAAC;CACrD,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,eAAe,KAAa,cAA2C;CACrF,MAAM,IAAI,IAAI,QAAQ,GAAG;CACzB,IAAI,MAAM,IAAI,OAAO;CACrB,MAAM,SAAS,IAAI,QAAQ,KAAK,CAAC;CACjC,MAAM,QAAQ,IAAI,MAAM,IAAI,GAAG,WAAW,KAAK,KAAA,IAAY,MAAM;CACjE,MAAM,OAAO,WAAW,KAAK,KAAK,IAAI,MAAM,MAAM;CAClD,MAAM,UAAU,MACb,MAAM,GAAG,CAAC,CACV,KAAK,SAAS;EACb,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,MAAM,SAAS,OAAO,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE;EAClD,MAAM,UAAU,WAAW,MAAM;EACjC,MAAM,UAAU,QAAQ,QAAQ,GAAG;EACnC,MAAM,QAAQ,YAAY,KAAK,UAAU,QAAQ,MAAM,GAAG,OAAO,EAAA,CAAG,YAAY;EAChF,OAAO,aAAa,IAAI,IAAI,KAAK,OAAO,KAAK,GAAG,OAAO,eAAe;CACxE,CAAC,CAAC,CACD,KAAK,GAAG;CACX,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,UAAU;AACzC;;AAGA,SAAgB,aACd,UACA,OACa;CACb,OAAO,IAAI,IAAI,CAAC,GAAG,UAAU,GAAI,SAAS,CAAC,CAAE,CAAC,CAAC,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC;AAC5E;AAEA,MAAM,WAAW;AACjB,MAAM,mBAAmB;AAEzB,SAAS,YAAY,QAAwB;CAC3C,MAAM,UAAU,WAAW,MAAM;CACjC,MAAM,UAAU,QAAQ,QAAQ,GAAG;CACnC,QAAQ,YAAY,KAAK,UAAU,QAAQ,MAAM,GAAG,OAAO,EAAA,CAAG,YAAY;AAC5E;;;;;AAMA,SAAgB,qBAAqB,KAAa,OAAsC;CACtF,MAAM,IAAI,IAAI,QAAQ,GAAG;CACzB,IAAI,MAAM,IAAI,OAAO,CAAC;CACtB,MAAM,SAAS,IAAI,QAAQ,KAAK,CAAC;CACjC,MAAM,QAAQ,IAAI,MAAM,IAAI,GAAG,WAAW,KAAK,KAAA,IAAY,MAAM;CACjE,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,QAAQ,MAAM,MAAM,GAAG,GAAG;EACnC,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,OAAO,MAAM,CAAC,MAAM,IAAI,YAAY,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,GAAG;EAC7D,MAAM,MAAM,KAAK,MAAM,KAAK,CAAC;EAC7B,KAAK,MAAM,SAAS,CAAC,KAAK,WAAW,GAAG,CAAC,GACvC,IAAI,MAAM,UAAU,oBAAoB,UAAU,UAAU,MAAM,IAAI,KAAK;CAE/E;CACA,OAAO,CAAC,GAAG,KAAK;AAClB;;AAGA,SAAgB,YAAY,MAAc,QAAmC;CAC3E,IAAI,OAAO,WAAW,KAAK,KAAK,WAAW,GAAG,OAAO;CACrD,IAAI,MAAM;CACV,KAAK,MAAM,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAChE,IAAI,MAAM,SAAS,KAAK,IAAI,SAAS,KAAK,GAAG,MAAM,IAAI,MAAM,KAAK,CAAC,CAAC,KAAK,QAAQ;CAEnF,OAAO;AACT;AAEA,SAAS,gBAAgB,IAAqB;CAC5C,OACE,OAAO,OACP,OAAO,QACP,OAAO,QACP,OAAO,OACP,OAAO,QACP,OAAO,OACP,OAAO;AAEX;;;;;AAMA,SAAgB,iBAAiB,MAAc,OAAoC;CACjF,IAAI,IAAI,KAAK,QAAQ,GAAG;CACxB,IAAI,MAAM,IAAI,OAAO;CACrB,IAAI,MAAM;CACV,IAAI,SAAS;CACb,OAAO,MAAM,IAAI;EACf,IAAI,MAAM,IAAI;EACd,OAAO,MAAM,KAAK,UAAU,CAAC,gBAAgB,KAAK,OAAO,GAAG,CAAC,GAAG;EAChE,OAAO,KAAK,MAAM,QAAQ,CAAC,IAAI,eAAe,KAAK,MAAM,GAAG,GAAG,GAAG,KAAK;EACvE,SAAS;EACT,IAAI,KAAK,QAAQ,KAAK,GAAG;CAC3B;CACA,OAAO,MAAM,KAAK,MAAM,MAAM;AAChC;;AAGA,SAAgB,aACd,MACA,OACA,QACQ;CACR,OAAO,YAAY,iBAAiB,MAAM,KAAK,GAAG,MAAM;AAC1D"}

package/dist/{slack.transport-BDyENuR0.d.mts → slack.transport-5OPL7H3u.d.mts}

@@ -1,4 +1,4 @@
-import { _ as TransportLogEntry, l as IAsyncTransport } from "./transport.types-CzJq4IrF.mjs";
+import { _ as TransportLogEntry, l as IAsyncTransport } from "./transport.types-B1ejJJP6.mjs";
 interface OtlpLogTransportConfig {
   /** OTLP/HTTP logs endpoint, e.g. `http://localhost:4318/v1/logs`. */
   url: string;
@@ -18,6 +18,11 @@ interface OtlpLogTransportConfig {
   flushIntervalMs?: number;
   /** Abort a request that has not finished after this many ms. Default: 10000. */
   requestTimeoutMs?: number;
+  /**
+   * Request timeout (ms) while closing, so a hung collector cannot outlast the
+   * shutdown budget (5 s by default); also caps a request already in flight when close() starts, and close() tries twice. Default: 1500.
+   */
+  closeTimeoutMs?: number;
   /** Max buffered entries; the oldest are dropped past this. Default: 10000. */
   maxBufferSize?: number;
   level?: string;
@@ -39,6 +44,9 @@ declare class OtlpLogTransport implements IAsyncTransport {
   private readonly batchSize;
   private readonly flushIntervalMs;
   private readonly requestTimeoutMs;
+  private readonly closeTimeoutMs;
+  private closing;
+  private readonly inFlight;
   private readonly resourceAttrs;
   private readonly buffer;
   private flushTimer;
@@ -108,6 +116,71 @@ declare class DiscordTransport implements IAsyncTransport {
   private fitToBudget;
   private draftFor;
 }
+type SentrySeverity = 'fatal' | 'error' | 'warning' | 'log' | 'info' | 'debug';
+type SentryLogMethod = 'trace' | 'debug' | 'info' | 'warn' | 'error' | 'fatal';
+/** The part of a Sentry scope the transport uses. `withScope` hands one to its callback. */
+interface SentryScopeLike {
+  setLevel(level: SentrySeverity): unknown;
+  setTag(key: string, value: string): unknown;
+  setExtras(extras: Record<string, unknown>): unknown;
+  setContext(name: string, context: Record<string, unknown> | null): unknown;
+}
+/** The part of the Sentry Logs API (`Sentry.logger`, SDK 9.41+) the transport uses. */
+type SentryLoggerLike = Partial<Record<SentryLogMethod, (message: string, attributes?: Record<string, unknown>) => unknown>>;
+/**
+ * The part of the Sentry JS namespace the transport calls (`import * as Sentry from
+ * '@sentry/node'` satisfies it). Only the two capture functions are required.
+ */
+interface SentryLike {
+  captureException(exception: unknown, hint?: unknown): unknown;
+  captureMessage(message: string, hint?: unknown): unknown;
+  addBreadcrumb?(breadcrumb: Record<string, unknown>): unknown;
+  withScope?(callback: (scope: SentryScopeLike) => void): unknown;
+  logger?: SentryLoggerLike;
+  flush?(timeout?: number): PromiseLike<unknown>;
+}
+interface SentryTransportConfig {
+  /** Your initialised Sentry namespace, e.g. `import * as Sentry from '@sentry/node'`. */
+  sentry: SentryLike;
+  /**
+   * Lowest level sent as a Sentry event. Lower levels become breadcrumbs or logs.
+   * A logixia level name; compared by its Sentry severity. Default: 'error'.
+   */
+  minLevel?: string;
+  /**
+   * Send levels below `minLevel` to the Sentry Logs API (`sentry.logger`) instead of
+   * breadcrumbs. Needs SDK 9.41+ with `enableLogs: true` in `Sentry.init` (on by default
+   * from 10.71). Default: false. Without `sentry.logger` it falls back to breadcrumbs.
+   */
+  logs?: boolean;
+  /** Record levels below `minLevel` as breadcrumbs (when not sent as logs). Default: true. */
+  breadcrumbs?: boolean;
+  /** Extra or overriding level -> Sentry severity mappings, e.g. for custom levels. */
+  levelMap?: Record<string, SentrySeverity>;
+  /** Max ms `flush()` and `close()` wait for `sentry.flush`. Default: 2000. */
+  flushTimeoutMs?: number;
+  filter?: (entry: TransportLogEntry) => boolean;
+}
+declare class SentryTransport implements IAsyncTransport {
+  readonly name = "sentry";
+  filter?: (entry: TransportLogEntry) => boolean;
+  private readonly sentry;
+  private readonly minRank;
+  private readonly useLogs;
+  private readonly useBreadcrumbs;
+  private readonly levelMap;
+  private readonly flushTimeoutMs;
+  private warnedNoLogger;
+  constructor(config: SentryTransportConfig);
+  write(entry: TransportLogEntry): void;
+  flush(): Promise<void>;
+  /** Flushes pending events; the Sentry client itself stays open for the application. */
+  close(): Promise<void>;
+  private severityOf;
+  private captureEvent;
+  private sendLog;
+  private addBreadcrumb;
+}
 /** A Slack message body as returned by a custom `formatter`. */
 interface SlackMessage {
   text?: string;
@@ -155,5 +228,5 @@ declare class SlackTransport implements IAsyncTransport {
   private buildPayload;
   private messageFor;
 }
-export { DiscordTransport as a, OtlpLogTransportConfig as c, DiscordEmbed as i, toOtelSeverity as l, SlackTransport as n, DiscordTransportConfig as o, SlackTransportConfig as r, OtlpLogTransport as s, SlackMessage as t };
-//# sourceMappingURL=slack.transport-BDyENuR0.d.mts.map
+export { SentryLoggerLike as a, SentryTransport as c, DiscordTransport as d, DiscordTransportConfig as f, toOtelSeverity as h, SentryLike as i, SentryTransportConfig as l, OtlpLogTransportConfig as m, SlackTransport as n, SentryScopeLike as o, OtlpLogTransport as p, SlackTransportConfig as r, SentrySeverity as s, SlackMessage as t, DiscordEmbed as u };
+//# sourceMappingURL=slack.transport-5OPL7H3u.d.mts.map

package/dist/slack.transport-5OPL7H3u.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.transport-5OPL7H3u.d.mts","names":[],"sources":["../src/transports/otlp.transport.ts","../src/transports/discord.transport.ts","../src/transports/sentry.transport.ts","../src/transports/slack.transport.ts"],"mappings":";UAuCiB;;EAEf;;EAEA,UAAU;;EAEV;;EAEA;;EAEA;;EAEA,qBAAqB;;EAErB;;EAEA;;EAEA;;;;;EAKA;;EAEA;EACA;;;;;;;iBA4Bc,eAAe;EAAkB;EAAgB;;cA4GpD,4BAA4B;WACvB;WACA;mBAEC;mBACA;mBACA;mBACA;mBACA;mBACA;UACT;mBACS;mBACA;mBAEA;UACT;EAEI,YAAA,QAAQ;EAgCpB,MAAM,OAAO;;UAML;UA+BA;EAgBR,SAAS;UAID;UAIM;EAiCR,SAAS;;UC1SA;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA;EACA,SAAS;GACR;;UAGc;;EAEf;;EAEA;EACA;;EAEA;;EAEA;;;;;EAKA,aAAa,OAAO,sBAAsB;EAC1C,UAAU,OAAO;;EAEjB;;EAEA;;EAEA;EACA;;cA0FW,4BAA4B;WACvB;WACA;EACT,UAAU,OAAO;mBAEP;mBACA;mBACA;mBACA;EAEL,YAAA,QAAQ;EAiCpB,MAAM,OAAO;EAMb,SAAS;EAIT,SAAS;;EAKT,UAAU;UASF;;UAoBA;UAgBA;;KC9PE;KACP;;UAGY;EACf,SAAS,OAAO;EAChB,OAAO,aAAa;EACpB,UAAU,QAAQ;EAClB,WAAW,cAAc,SAAS;;;KAIxB,mBAAmB,QAC7B,OAAO,kBAAkB,iBAAiB,aAAa;;;;;UAOxC;EACf,iBAAiB,oBAAoB;EACrC,eAAe,iBAAiB;EAChC,eAAe,YAAY;EAC3B,WAAW,WAAW,OAAO;EAC7B,SAAS;EACT,OAAO,mBAAmB;;UAGX;;EAEf,QAAQ;;;;;EAKR;;;;;;EAMA;;EAEA;;EAEA,WAAW,eAAe;;EAE1B;EACA,UAAU,OAAO;;cAiDN,2BAA2B;WACtB;EACT,UAAU,OAAO;mBAEP;mBACA;mBACA;mBACA;mBACA;mBACA;UACT;EAEI,YAAA,QAAQ;EAyBpB,MAAM,OAAO;EAeP,SAAS;;EAkBf,SAAS;UAID;UAIA;UAiCA;UAuBA;;;UCxNO;EACf;EACA;GACC;;UAGc;;EAEf;;EAEA;EACA;EACA;;EAEA;;;;;;EAMA,aAAa,OAAO,sBAAsB;EAC1C,UAAU,OAAO;;EAEjB;;EAEA;;EAEA;EACA;;cAgBW,0BAA0B;WACrB;WACA;EACT,UAAU,OAAO;mBAEP;mBACA;mBACA;mBACA;EAEL,YAAA,QAAQ;EA4BpB,MAAM,OAAO;EAMb,SAAS;EAIT,SAAS;;EAKT,UAAU;UASF;UAiBA"}

package/dist/{slack.transport-C6E0l4kw.d.ts → slack.transport-BFpBD_Ri.d.ts}

@@ -1,4 +1,4 @@
-import { _ as TransportLogEntry, l as IAsyncTransport } from "./transport.types-CzJq4IrF.js";
+import { _ as TransportLogEntry, l as IAsyncTransport } from "./transport.types-B1ejJJP6.js";
 interface OtlpLogTransportConfig {
   /** OTLP/HTTP logs endpoint, e.g. `http://localhost:4318/v1/logs`. */
   url: string;
@@ -18,6 +18,11 @@ interface OtlpLogTransportConfig {
   flushIntervalMs?: number;
   /** Abort a request that has not finished after this many ms. Default: 10000. */
   requestTimeoutMs?: number;
+  /**
+   * Request timeout (ms) while closing, so a hung collector cannot outlast the
+   * shutdown budget (5 s by default); also caps a request already in flight when close() starts, and close() tries twice. Default: 1500.
+   */
+  closeTimeoutMs?: number;
   /** Max buffered entries; the oldest are dropped past this. Default: 10000. */
   maxBufferSize?: number;
   level?: string;
@@ -39,6 +44,9 @@ declare class OtlpLogTransport implements IAsyncTransport {
   private readonly batchSize;
   private readonly flushIntervalMs;
   private readonly requestTimeoutMs;
+  private readonly closeTimeoutMs;
+  private closing;
+  private readonly inFlight;
   private readonly resourceAttrs;
   private readonly buffer;
   private flushTimer;
@@ -108,6 +116,71 @@ declare class DiscordTransport implements IAsyncTransport {
   private fitToBudget;
   private draftFor;
 }
+type SentrySeverity = 'fatal' | 'error' | 'warning' | 'log' | 'info' | 'debug';
+type SentryLogMethod = 'trace' | 'debug' | 'info' | 'warn' | 'error' | 'fatal';
+/** The part of a Sentry scope the transport uses. `withScope` hands one to its callback. */
+interface SentryScopeLike {
+  setLevel(level: SentrySeverity): unknown;
+  setTag(key: string, value: string): unknown;
+  setExtras(extras: Record<string, unknown>): unknown;
+  setContext(name: string, context: Record<string, unknown> | null): unknown;
+}
+/** The part of the Sentry Logs API (`Sentry.logger`, SDK 9.41+) the transport uses. */
+type SentryLoggerLike = Partial<Record<SentryLogMethod, (message: string, attributes?: Record<string, unknown>) => unknown>>;
+/**
+ * The part of the Sentry JS namespace the transport calls (`import * as Sentry from
+ * '@sentry/node'` satisfies it). Only the two capture functions are required.
+ */
+interface SentryLike {
+  captureException(exception: unknown, hint?: unknown): unknown;
+  captureMessage(message: string, hint?: unknown): unknown;
+  addBreadcrumb?(breadcrumb: Record<string, unknown>): unknown;
+  withScope?(callback: (scope: SentryScopeLike) => void): unknown;
+  logger?: SentryLoggerLike;
+  flush?(timeout?: number): PromiseLike<unknown>;
+}
+interface SentryTransportConfig {
+  /** Your initialised Sentry namespace, e.g. `import * as Sentry from '@sentry/node'`. */
+  sentry: SentryLike;
+  /**
+   * Lowest level sent as a Sentry event. Lower levels become breadcrumbs or logs.
+   * A logixia level name; compared by its Sentry severity. Default: 'error'.
+   */
+  minLevel?: string;
+  /**
+   * Send levels below `minLevel` to the Sentry Logs API (`sentry.logger`) instead of
+   * breadcrumbs. Needs SDK 9.41+ with `enableLogs: true` in `Sentry.init` (on by default
+   * from 10.71). Default: false. Without `sentry.logger` it falls back to breadcrumbs.
+   */
+  logs?: boolean;
+  /** Record levels below `minLevel` as breadcrumbs (when not sent as logs). Default: true. */
+  breadcrumbs?: boolean;
+  /** Extra or overriding level -> Sentry severity mappings, e.g. for custom levels. */
+  levelMap?: Record<string, SentrySeverity>;
+  /** Max ms `flush()` and `close()` wait for `sentry.flush`. Default: 2000. */
+  flushTimeoutMs?: number;
+  filter?: (entry: TransportLogEntry) => boolean;
+}
+declare class SentryTransport implements IAsyncTransport {
+  readonly name = "sentry";
+  filter?: (entry: TransportLogEntry) => boolean;
+  private readonly sentry;
+  private readonly minRank;
+  private readonly useLogs;
+  private readonly useBreadcrumbs;
+  private readonly levelMap;
+  private readonly flushTimeoutMs;
+  private warnedNoLogger;
+  constructor(config: SentryTransportConfig);
+  write(entry: TransportLogEntry): void;
+  flush(): Promise<void>;
+  /** Flushes pending events; the Sentry client itself stays open for the application. */
+  close(): Promise<void>;
+  private severityOf;
+  private captureEvent;
+  private sendLog;
+  private addBreadcrumb;
+}
 /** A Slack message body as returned by a custom `formatter`. */
 interface SlackMessage {
   text?: string;
@@ -155,5 +228,5 @@ declare class SlackTransport implements IAsyncTransport {
   private buildPayload;
   private messageFor;
 }
-export { DiscordTransport as a, OtlpLogTransportConfig as c, DiscordEmbed as i, toOtelSeverity as l, SlackTransport as n, DiscordTransportConfig as o, SlackTransportConfig as r, OtlpLogTransport as s, SlackMessage as t };
-//# sourceMappingURL=slack.transport-C6E0l4kw.d.ts.map
+export { SentryLoggerLike as a, SentryTransport as c, DiscordTransport as d, DiscordTransportConfig as f, toOtelSeverity as h, SentryLike as i, SentryTransportConfig as l, OtlpLogTransportConfig as m, SlackTransport as n, SentryScopeLike as o, OtlpLogTransport as p, SlackTransportConfig as r, SentrySeverity as s, SlackMessage as t, DiscordEmbed as u };
+//# sourceMappingURL=slack.transport-BFpBD_Ri.d.ts.map

package/dist/slack.transport-BFpBD_Ri.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.transport-BFpBD_Ri.d.ts","names":[],"sources":["../src/transports/otlp.transport.ts","../src/transports/discord.transport.ts","../src/transports/sentry.transport.ts","../src/transports/slack.transport.ts"],"mappings":";UAuCiB;;EAEf;;EAEA,UAAU;;EAEV;;EAEA;;EAEA;;EAEA,qBAAqB;;EAErB;;EAEA;;EAEA;;;;;EAKA;;EAEA;EACA;;;;;;;iBA4Bc,eAAe;EAAkB;EAAgB;;cA4GpD,4BAA4B;WACvB;WACA;mBAEC;mBACA;mBACA;mBACA;mBACA;mBACA;UACT;mBACS;mBACA;mBAEA;UACT;EAEI,YAAA,QAAQ;EAgCpB,MAAM,OAAO;;UAML;UA+BA;EAgBR,SAAS;UAID;UAIM;EAiCR,SAAS;;UC1SA;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA;EACA,SAAS;GACR;;UAGc;;EAEf;;EAEA;EACA;;EAEA;;EAEA;;;;;EAKA,aAAa,OAAO,sBAAsB;EAC1C,UAAU,OAAO;;EAEjB;;EAEA;;EAEA;EACA;;cA0FW,4BAA4B;WACvB;WACA;EACT,UAAU,OAAO;mBAEP;mBACA;mBACA;mBACA;EAEL,YAAA,QAAQ;EAiCpB,MAAM,OAAO;EAMb,SAAS;EAIT,SAAS;;EAKT,UAAU;UASF;;UAoBA;UAgBA;;KC9PE;KACP;;UAGY;EACf,SAAS,OAAO;EAChB,OAAO,aAAa;EACpB,UAAU,QAAQ;EAClB,WAAW,cAAc,SAAS;;;KAIxB,mBAAmB,QAC7B,OAAO,kBAAkB,iBAAiB,aAAa;;;;;UAOxC;EACf,iBAAiB,oBAAoB;EACrC,eAAe,iBAAiB;EAChC,eAAe,YAAY;EAC3B,WAAW,WAAW,OAAO;EAC7B,SAAS;EACT,OAAO,mBAAmB;;UAGX;;EAEf,QAAQ;;;;;EAKR;;;;;;EAMA;;EAEA;;EAEA,WAAW,eAAe;;EAE1B;EACA,UAAU,OAAO;;cAiDN,2BAA2B;WACtB;EACT,UAAU,OAAO;mBAEP;mBACA;mBACA;mBACA;mBACA;mBACA;UACT;EAEI,YAAA,QAAQ;EAyBpB,MAAM,OAAO;EAeP,SAAS;;EAkBf,SAAS;UAID;UAIA;UAiCA;UAuBA;;;UCxNO;EACf;EACA;GACC;;UAGc;;EAEf;;EAEA;EACA;EACA;;EAEA;;;;;;EAMA,aAAa,OAAO,sBAAsB;EAC1C,UAAU,OAAO;;EAEjB;;EAEA;;EAEA;EACA;;cAgBW,0BAA0B;WACrB;WACA;EACT,UAAU,OAAO;mBAEP;mBACA;mBACA;mBACA;EAEL,YAAA,QAAQ;EA4BpB,MAAM,OAAO;EAMb,SAAS;EAIT,SAAS;;EAKT,UAAU;UASF;UAiBA"}