logixia 2.2.0 → 2.3.1

package/dist/request-trace-txUhyyre.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-trace-txUhyyre.mjs","names":[],"sources":["../src/utils/trace.utils.ts","../src/utils/request-trace.ts"],"sourcesContent":["/**\n * Trace ID utilities for Logitron\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { randomUUID } from 'node:crypto';\n\nimport type { TraceIdConfig, TraceIdExtractorConfig } from '../types';\n\n/** Default key used to store the trace ID in AsyncLocalStorage. */\nexport const TRACE_CONTEXT_KEY = 'traceId' as const;\n\n// ── TraceContext class ────────────────────────────────────────────────────────\n\n/**\n * Singleton that owns the AsyncLocalStorage and the active contextKey.\n *\n * Why a class instead of bare module-level variables?\n *  - The contextKey is user-configurable; encapsulating it here means there is\n *    exactly one place that reads and writes it.\n *  - All helpers (getCurrentTraceId, runWithTraceId, etc.) delegate to this\n *    instance, so the key is always in sync without hidden global state.\n *  - Easier to test: you can reset the singleton between test cases.\n *\n * Usage (advanced):\n *   import { TraceContext } from 'logixia';\n *   TraceContext.instance.contextKey          // → 'traceId' (or custom)\n *   TraceContext.instance.getCurrentTraceId() // same as standalone fn\n */\nexport class TraceContext {\n  private static _instance: TraceContext | null = null;\n\n  readonly storage = new AsyncLocalStorage<Record<string, unknown>>();\n  private _contextKey: string = TRACE_CONTEXT_KEY;\n\n  private constructor() {}\n\n  /** The process-wide singleton. */\n  static get instance(): TraceContext {\n    if (!TraceContext._instance) {\n      TraceContext._instance = new TraceContext();\n    }\n    return TraceContext._instance;\n  }\n\n  /** @internal Reset the singleton (useful in tests). */\n  static _reset(): void {\n    TraceContext._instance = null;\n  }\n\n  // ── Key management ──────────────────────────────────────────────────────────\n\n  /** The AsyncLocalStorage key that holds the trace ID value. */\n  get contextKey(): string {\n    return this._contextKey;\n  }\n\n  /** @internal Called by TraceMiddleware when it boots to register the user's key. */\n  setContextKey(key: string): void {\n    this._contextKey = key;\n  }\n\n  // ── Core operations ─────────────────────────────────────────────────────────\n\n  /** UUID v4 generator (default). */\n  generate(): string {\n    return randomUUID();\n  }\n\n  /** Read the trace ID from the current async context. */\n  getCurrentTraceId(): string | undefined {\n    return this.storage.getStore()?.[this._contextKey] as string | undefined;\n  }\n\n  /**\n   * Mutate the CURRENT async context in-place.\n   *\n   * ⚠️  DEPRECATED — unsafe for concurrent requests.\n   *\n   * Uses `AsyncLocalStorage.enterWith()`, which mutates the current async\n   * execution context and every Promise chain spawned from it. In a server\n   * processing overlapping requests this can cause a trace ID set for one\n   * request to bleed into *other* in-flight requests that share the same\n   * async parent (e.g. a module-level setup function or a cached handler).\n   *\n   * Use {@link run} instead — it scopes the context to a callback so there\n   * is no risk of cross-request leakage.\n   *\n   * @deprecated Use `TraceContext.instance.run(traceId, fn)` — do not call\n   *             `setTraceId` from request-handling code.\n   */\n  setTraceId(traceId: string, data?: Record<string, unknown>): void {\n    const current = this.storage.getStore() ?? {};\n    this.storage.enterWith({ ...current, [this._contextKey]: traceId, ...data });\n  }\n\n  /** Run `fn` inside a new async context that carries `traceId`. */\n  run<T>(traceId: string, fn: () => T, data?: Record<string, unknown>): T {\n    return this.storage.run({ [this._contextKey]: traceId, ...data }, fn);\n  }\n}\n\n// ── Module-level aliases (backwards-compatible public API) ────────────────────\n\n/**\n * The shared AsyncLocalStorage instance.\n * @deprecated Prefer `TraceContext.instance.storage` for new code.\n */\nexport const traceStorage = TraceContext.instance.storage;\n\n/** Returns the key currently used to store the trace ID in AsyncLocalStorage. */\nexport function getTraceContextKey(): string {\n  return TraceContext.instance.contextKey;\n}\n\n/** @internal Called by TraceMiddleware / traceMiddleware() when they boot. */\nexport function _setActiveContextKey(key: string): void {\n  TraceContext.instance.setContextKey(key);\n}\n\n/** Generate a UUID v4 trace ID. */\nexport function generateTraceId(): string {\n  return TraceContext.instance.generate();\n}\n\n/**\n * Get the current trace ID from async context.\n * Returns `undefined` when called outside a traced request.\n */\nexport function getCurrentTraceId(): string | undefined {\n  return TraceContext.instance.getCurrentTraceId();\n}\n\n/**\n * Set trace ID in the CURRENT async context without starting a new one.\n *\n * ⚠️  DEPRECATED — unsafe for concurrent requests.\n *\n * Uses `AsyncLocalStorage.enterWith()`, which mutates the current async\n * execution context and every Promise chain spawned from it. Under load this\n * can cause a trace ID from one request to bleed into others sharing the same\n * async parent.\n *\n * Use {@link runWithTraceId} instead. Migration patterns:\n *\n * **Express / Fastify middleware — before:**\n * ```ts\n * app.use((req, _res, next) => {\n *   setTraceId(req.headers['x-trace-id'] ?? generateTraceId());\n *   next();\n * });\n * ```\n * **after:**\n * ```ts\n * app.use((req, _res, next) => {\n *   runWithTraceId(req.headers['x-trace-id'] ?? generateTraceId(), () => next());\n * });\n * ```\n *\n * **Kafka / queue consumer — before:**\n * ```ts\n * async function handle(msg) {\n *   setTraceId(msg.headers['x-trace-id']);\n *   await processMessage(msg);\n * }\n * ```\n * **after:**\n * ```ts\n * async function handle(msg) {\n *   await runWithTraceId(msg.headers['x-trace-id'], () => processMessage(msg));\n * }\n * ```\n *\n * **Background job — before:**\n * ```ts\n * setTraceId(generateTraceId(), { jobId: job.id });\n * await job.run();\n * ```\n * **after:**\n * ```ts\n * await runWithTraceId(generateTraceId(), () => job.run(), { jobId: job.id });\n * ```\n *\n * @deprecated Use `runWithTraceId(traceId, fn)` — do not call `setTraceId`\n *             from request-handling code.\n */\nexport function setTraceId(traceId: string, data?: Record<string, unknown>): void {\n  TraceContext.instance.setTraceId(traceId, data);\n}\n\n/** Run `fn` inside a new async context carrying `traceId`. */\nexport function runWithTraceId<T>(traceId: string, fn: () => T, data?: Record<string, unknown>): T {\n  return TraceContext.instance.run(traceId, fn, data);\n}\n\n// ── Request extraction ────────────────────────────────────────────────────────\n\ntype HeaderValue = string | string[] | undefined;\n\n/** Shape that extractTraceId accepts (Express-compatible) */\ninterface RequestLike {\n  headers?: Record<string, HeaderValue>;\n  query?: Record<string, HeaderValue>;\n  body?: Record<string, string | undefined>;\n  params?: Record<string, string | undefined>;\n}\n\n/** Maximum accepted length for an incoming trace / correlation / request ID. */\nexport const MAX_INCOMING_ID_LENGTH = 128;\n\nconst SAFE_INCOMING_ID = /^[A-Za-z0-9._:-]{1,128}$/;\n\n/**\n * Validate an externally supplied identifier (trace ID, correlation ID, origin\n * service name, message-queue ID). Accepts only 1-128 characters from\n * `[A-Za-z0-9._:-]`; surrounding whitespace is trimmed first. Arrays use their\n * first element. Returns the cleaned value, or `undefined` when it is unusable\n * so callers can generate a fresh ID instead of passing client text through.\n */\nexport function sanitizeIncomingId(value: unknown): string | undefined {\n  const first = Array.isArray(value) ? value[0] : value;\n  if (typeof first !== 'string' || first.length > MAX_INCOMING_ID_LENGTH * 2) return undefined;\n  const trimmed = first.trim();\n  return SAFE_INCOMING_ID.test(trimmed) ? trimmed : undefined;\n}\n\n/** W3C trace-context: `version-traceId(32hex)-spanId(16hex)-flags(2hex)`. */\nconst W3C_TRACEPARENT_RE = /^[\\da-f]{2}-([\\da-f]{32})-[\\da-f]{16}-[\\da-f]{2}$/i;\n\n/**\n * Extract the 32-hex trace-id segment from a W3C `traceparent` header value.\n * Returns the parsed trace ID, or the original value unchanged when it is not a\n * well-formed traceparent (so non-W3C propagation still works).\n */\nfunction parseTraceparent(value: string): string {\n  const m = W3C_TRACEPARENT_RE.exec(value);\n  return m ? m[1]! : value;\n}\n\n/** Extract trace ID from request using configuration (header → query → body → params). */\nexport function extractTraceId(\n  request: unknown,\n  config: TraceIdExtractorConfig\n): string | undefined {\n  const req = request as RequestLike;\n\n  if (config.header) {\n    const headers = Array.isArray(config.header) ? config.header : [config.header];\n    for (const header of headers) {\n      const lower = header.toLowerCase();\n      const value = sanitizeIncomingId(req.headers?.[lower]);\n      if (value) return lower === 'traceparent' ? parseTraceparent(value) : value;\n    }\n  }\n\n  if (config.query) {\n    const queries = Array.isArray(config.query) ? config.query : [config.query];\n    for (const query of queries) {\n      const value = sanitizeIncomingId(req.query?.[query]);\n      if (value) return value;\n    }\n  }\n\n  if (config.body) {\n    const bodyFields = Array.isArray(config.body) ? config.body : [config.body];\n    for (const field of bodyFields) {\n      const value = sanitizeIncomingId(req.body?.[field]);\n      if (value) return value;\n    }\n  }\n\n  if (config.params) {\n    const paramFields = Array.isArray(config.params) ? config.params : [config.params];\n    for (const param of paramFields) {\n      const value = sanitizeIncomingId(req.params?.[param]);\n      if (value) return value;\n    }\n  }\n\n  return undefined;\n}\n\n/**\n * Default headers checked for incoming trace ID propagation, in priority order:\n *   traceparent (W3C/OTel) → x-trace-id → x-request-id → x-correlation-id → trace-id\n */\nexport const DEFAULT_TRACE_HEADERS = [\n  'traceparent',\n  'x-trace-id',\n  'x-request-id',\n  'x-correlation-id',\n  'trace-id',\n];\n\n/**\n * Create trace ID middleware for Express/NestJS\n */\nexport function createTraceMiddleware(config: TraceIdConfig) {\n  const defaultExtractor = {\n    header: DEFAULT_TRACE_HEADERS,\n    query: ['traceId', 'trace_id'],\n  };\n  const resolvedConfig: TraceIdConfig = {\n    ...config,\n    extractor: config?.extractor ? { ...defaultExtractor, ...config.extractor } : defaultExtractor,\n  };\n\n  _setActiveContextKey(resolvedConfig.contextKey ?? TRACE_CONTEXT_KEY);\n\n  return (req: unknown, res: unknown, next: () => void) => {\n    let traceId: string | undefined;\n\n    if (resolvedConfig.extractor) {\n      traceId = extractTraceId(req, resolvedConfig.extractor);\n    }\n\n    if (!traceId) {\n      traceId = resolvedConfig.generator ? resolvedConfig.generator() : generateTraceId();\n    }\n\n    (req as Record<string, unknown>).traceId = traceId;\n    // Echo the trace ID back on the response, tolerating different response APIs:\n    // Express/Node use res.setHeader(), Fastify replies use reply.header(). Guard\n    // both and never let a missing/!function method (or already-sent headers)\n    // crash the request — the trace ID is still propagated via async context.\n    const resObj = res as {\n      setHeader?: (k: string, v: string) => void;\n      header?: (k: string, v: string) => void;\n      headersSent?: boolean;\n    };\n    if (!resObj.headersSent) {\n      try {\n        if (typeof resObj.setHeader === 'function') {\n          resObj.setHeader('X-Trace-Id', traceId);\n        } else if (typeof resObj.header === 'function') {\n          resObj.header('X-Trace-Id', traceId);\n        }\n      } catch {\n        /* response not in a header-settable state — context propagation still works */\n      }\n    }\n\n    runWithTraceId(traceId, () => next());\n  };\n}\n","/**\n * Per-request trace ID resolution shared by the HTTP logger middleware and the\n * context helpers. Internal: not re-exported from the package entry points.\n */\n\nimport type { HttpRequestShape } from '../types/http-shapes';\nimport {\n  DEFAULT_TRACE_HEADERS,\n  extractTraceId,\n  generateTraceId,\n  sanitizeIncomingId,\n} from './trace.utils';\n\nexport type TraceHeaderOption = string | readonly string[];\n\n/** Minimal structural request shape; Express and Fastify requests satisfy it. */\nexport type ContextRequestLike = HttpRequestShape;\n\n/** Fastify's default `genReqId` output (`req-` + base36 counter), unique only per process. */\nconst FASTIFY_COUNTER_ID = /^req-[\\da-z]+$/;\n\nconst FALLBACK_KEY = '_logixiaFallbackId';\n\n/** A caller-supplied request ID that is safe to use as a trace ID, or `undefined` for a counter ID. */\nexport function usableRequestId(id: unknown): string | undefined {\n  const sanitized = sanitizeIncomingId(id);\n  return sanitized !== undefined && !FASTIFY_COUNTER_ID.test(sanitized) ? sanitized : undefined;\n}\n\n/** Header names to read a trace ID from, defaulting to the library-wide list. */\nexport function resolveTraceHeaders(option: TraceHeaderOption | undefined): readonly string[] {\n  if (option === undefined) return DEFAULT_TRACE_HEADERS;\n  return typeof option === 'string' ? [option] : option;\n}\n\n/**\n * Resolve the trace ID for a request: a sanitised incoming header (honouring\n * `traceparent`), then a non-counter `request.id`, then a generated ID. Header\n * and `request.id` are recomputed per call so each caller's own header list is\n * honoured; only the generated fallback is stored on the request so every helper\n * agrees when no ID was sent.\n */\nexport function resolveRequestTraceId(req: ContextRequestLike, headers: readonly string[]): string {\n  const fromHeader = extractTraceId(req, { header: [...headers] });\n  if (fromHeader !== undefined) return fromHeader;\n\n  const fromId = usableRequestId(req.id);\n  if (fromId !== undefined) return fromId;\n\n  const holder = req as Record<string, unknown>;\n  const cached = holder[FALLBACK_KEY];\n  if (typeof cached === 'string') return cached;\n  const generated = generateTraceId();\n  try {\n    holder[FALLBACK_KEY] = generated;\n  } catch {\n    // frozen request object: each caller generates its own\n  }\n  return generated;\n}\n"],"mappings":";;;;;;;AAUA,MAAa,oBAAoB;;;;;;;;;;;;;;;;AAmBjC,IAAa,eAAb,MAAa,aAAa;CACxB,OAAe,YAAiC;CAEhD,UAAmB,IAAI,kBAA2C;CAClE,cAA8B;CAE9B,cAAsB,CAAC;;CAGvB,WAAW,WAAyB;EAClC,IAAI,CAAC,aAAa,WAChB,aAAa,YAAY,IAAI,aAAa;EAE5C,OAAO,aAAa;CACtB;;CAGA,OAAO,SAAe;EACpB,aAAa,YAAY;CAC3B;;CAKA,IAAI,aAAqB;EACvB,OAAO,KAAK;CACd;;CAGA,cAAc,KAAmB;EAC/B,KAAK,cAAc;CACrB;;CAKA,WAAmB;EACjB,OAAO,WAAW;CACpB;;CAGA,oBAAwC;;EACtC,QAAA,wBAAO,KAAK,QAAQ,SAAS,OAAA,QAAA,0BAAA,KAAA,IAAA,KAAA,IAAA,sBAAI,KAAK;CACxC;;;;;;;;;;;;;;;;;;CAmBA,WAAW,SAAiB,MAAsC;EAChE,MAAM,UAAU,KAAK,QAAQ,SAAS,KAAK,CAAC;EAC5C,KAAK,QAAQ,UAAU;GAAE,GAAG;IAAU,KAAK,cAAc;GAAS,GAAG;EAAK,CAAC;CAC7E;;CAGA,IAAO,SAAiB,IAAa,MAAmC;EACtE,OAAO,KAAK,QAAQ,IAAI;IAAG,KAAK,cAAc;GAAS,GAAG;EAAK,GAAG,EAAE;CACtE;AACF;;;;;AAQA,MAAa,eAAe,aAAa,SAAS;;AAGlD,SAAgB,qBAA6B;CAC3C,OAAO,aAAa,SAAS;AAC/B;;AAGA,SAAgB,qBAAqB,KAAmB;CACtD,aAAa,SAAS,cAAc,GAAG;AACzC;;AAGA,SAAgB,kBAA0B;CACxC,OAAO,aAAa,SAAS,SAAS;AACxC;;;;;AAMA,SAAgB,oBAAwC;CACtD,OAAO,aAAa,SAAS,kBAAkB;AACjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,SAAgB,WAAW,SAAiB,MAAsC;CAChF,aAAa,SAAS,WAAW,SAAS,IAAI;AAChD;;AAGA,SAAgB,eAAkB,SAAiB,IAAa,MAAmC;CACjG,OAAO,aAAa,SAAS,IAAI,SAAS,IAAI,IAAI;AACpD;;AAeA,MAAa,yBAAyB;AAEtC,MAAM,mBAAmB;;;;;;;;AASzB,SAAgB,mBAAmB,OAAoC;CACrE,MAAM,QAAQ,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK;CAChD,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAA4B,OAAO,KAAA;CACnF,MAAM,UAAU,MAAM,KAAK;CAC3B,OAAO,iBAAiB,KAAK,OAAO,IAAI,UAAU,KAAA;AACpD;;AAGA,MAAM,qBAAqB;;;;;;AAO3B,SAAS,iBAAiB,OAAuB;CAC/C,MAAM,IAAI,mBAAmB,KAAK,KAAK;CACvC,OAAO,IAAI,EAAE,KAAM;AACrB;;AAGA,SAAgB,eACd,SACA,QACoB;CACpB,MAAM,MAAM;CAEZ,IAAI,OAAO,QAAQ;EACjB,MAAM,UAAU,MAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,SAAS,CAAC,OAAO,MAAM;EAC7E,KAAK,MAAM,UAAU,SAAS;;GAC5B,MAAM,QAAQ,OAAO,YAAY;GACjC,MAAM,QAAQ,oBAAA,eAAmB,IAAI,aAAA,QAAA,iBAAA,KAAA,IAAA,KAAA,IAAA,aAAU,MAAM;GACrD,IAAI,OAAO,OAAO,UAAU,gBAAgB,iBAAiB,KAAK,IAAI;EACxE;CACF;CAEA,IAAI,OAAO,OAAO;EAChB,MAAM,UAAU,MAAM,QAAQ,OAAO,KAAK,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK;EAC1E,KAAK,MAAM,SAAS,SAAS;;GAC3B,MAAM,QAAQ,oBAAA,aAAmB,IAAI,WAAA,QAAA,eAAA,KAAA,IAAA,KAAA,IAAA,WAAQ,MAAM;GACnD,IAAI,OAAO,OAAO;EACpB;CACF;CAEA,IAAI,OAAO,MAAM;EACf,MAAM,aAAa,MAAM,QAAQ,OAAO,IAAI,IAAI,OAAO,OAAO,CAAC,OAAO,IAAI;EAC1E,KAAK,MAAM,SAAS,YAAY;;GAC9B,MAAM,QAAQ,oBAAA,YAAmB,IAAI,UAAA,QAAA,cAAA,KAAA,IAAA,KAAA,IAAA,UAAO,MAAM;GAClD,IAAI,OAAO,OAAO;EACpB;CACF;CAEA,IAAI,OAAO,QAAQ;EACjB,MAAM,cAAc,MAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,SAAS,CAAC,OAAO,MAAM;EACjF,KAAK,MAAM,SAAS,aAAa;;GAC/B,MAAM,QAAQ,oBAAA,cAAmB,IAAI,YAAA,QAAA,gBAAA,KAAA,IAAA,KAAA,IAAA,YAAS,MAAM;GACpD,IAAI,OAAO,OAAO;EACpB;CACF;AAGF;;;;;AAMA,MAAa,wBAAwB;CACnC;CACA;CACA;CACA;CACA;AACF;;;;AAKA,SAAgB,sBAAsB,QAAuB;CAC3D,MAAM,mBAAmB;EACvB,QAAQ;EACR,OAAO,CAAC,WAAW,UAAU;CAC/B;CACA,MAAM,iBAAgC;EACpC,GAAG;EACH,YAAA,WAAA,QAAA,WAAA,KAAA,IAAA,KAAA,IAAW,OAAQ,aAAY;GAAE,GAAG;GAAkB,GAAG,OAAO;EAAU,IAAI;CAChF;CAEA,qBAAqB,eAAe,cAAA,SAA+B;CAEnE,QAAQ,KAAc,KAAc,SAAqB;EACvD,IAAI;EAEJ,IAAI,eAAe,WACjB,UAAU,eAAe,KAAK,eAAe,SAAS;EAGxD,IAAI,CAAC,SACH,UAAU,eAAe,YAAY,eAAe,UAAU,IAAI,gBAAgB;EAGpF,IAAiC,UAAU;EAK3C,MAAM,SAAS;EAKf,IAAI,CAAC,OAAO,aACV,IAAI;GACF,IAAI,OAAO,OAAO,cAAc,YAC9B,OAAO,UAAU,cAAc,OAAO;QACjC,IAAI,OAAO,OAAO,WAAW,YAClC,OAAO,OAAO,cAAc,OAAO;EAEvC,QAAQ,CAER;EAGF,eAAe,eAAe,KAAK,CAAC;CACtC;AACF;;;ACrUA,MAAM,qBAAqB;AAE3B,MAAM,eAAe;;AAGrB,SAAgB,gBAAgB,IAAiC;CAC/D,MAAM,YAAY,mBAAmB,EAAE;CACvC,OAAO,cAAc,KAAA,KAAa,CAAC,mBAAmB,KAAK,SAAS,IAAI,YAAY,KAAA;AACtF;;AAGA,SAAgB,oBAAoB,QAA0D;CAC5F,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,OAAO,OAAO,WAAW,WAAW,CAAC,MAAM,IAAI;AACjD;;;;;;;;AASA,SAAgB,sBAAsB,KAAyB,SAAoC;CACjG,MAAM,aAAa,eAAe,KAAK,EAAE,QAAQ,CAAC,GAAG,OAAO,EAAE,CAAC;CAC/D,IAAI,eAAe,KAAA,GAAW,OAAO;CAErC,MAAM,SAAS,gBAAgB,IAAI,EAAE;CACrC,IAAI,WAAW,KAAA,GAAW,OAAO;CAEjC,MAAM,SAAS;CACf,MAAM,SAAS,OAAO;CACtB,IAAI,OAAO,WAAW,UAAU,OAAO;CACvC,MAAM,YAAY,gBAAgB;CAClC,IAAI;EACF,OAAO,gBAAgB;CACzB,QAAQ,CAER;CACA,OAAO;AACT"}

package/dist/secret-config-Cng7XPLx.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"secret-config-Cng7XPLx.mjs","names":[],"sources":["../src/transports/secret-config.ts"],"sourcesContent":["/**\n * Keeps credentials out of serialized transport output and error text.\n *\n * `protectSecrets()` replaces each listed field with a non-enumerable accessor backed\n * by a WeakMap, whether or not the field is assigned yet, so later assignments (a\n * connection opened on first write, a refreshed token) stay hidden too. It also\n * installs `toJSON()` and a Node inspect hook returning a redacted view: scalar\n * fields stay for debugging, secret-looking keys become '[REDACTED]', URLs lose\n * userinfo, query and fragment. No Node imports, so browser bundles can use it.\n */\n\nimport { assignOwn } from '../utils/own-property';\nimport {\n  DEFAULT_REDACT_QUERY_PARAMS,\n  SENSITIVE_KEY_NAMES,\n  TRANSPORT_CONFIG_SECRET_NAMES,\n} from '../utils/sensitive-names';\n\nexport const REDACTED = '[REDACTED]';\n\nconst INSPECT_CUSTOM = Symbol.for('nodejs.util.inspect.custom');\nconst MAX_DEPTH = 4;\nconst MIN_SECRET_LENGTH = 4;\nconst SCHEME_PREFIX = /^[a-z][a-z0-9+.-]*:\\/\\//i;\n/** `scheme://userinfo@`: userinfo runs to the LAST `@` before the path, so `p@ss` is covered. */\nconst USERINFO = /(\\b[a-z][a-z0-9+.-]*:\\/\\/)[^\\s/?#]*@/gi;\n\nfunction normalizeName(name: string): string {\n  return name.toLowerCase().replaceAll('-', '').replaceAll('_', '');\n}\n\nconst SECRET_NAMES = [...SENSITIVE_KEY_NAMES, ...TRANSPORT_CONFIG_SECRET_NAMES].map(normalizeName);\nconst QUERY_NAMES = new Set(DEFAULT_REDACT_QUERY_PARAMS.map(normalizeName));\n\n/** Exact match for short names (`key`, `pfx`), suffix match for longer ones (`azureClientSecret`). */\nfunction isSecretKey(key: string): boolean {\n  const name = normalizeName(key);\n  return SECRET_NAMES.some((n) => name === n || (n.length >= 5 && name.endsWith(n)));\n}\n\nfunction isUrlKey(key: string): boolean {\n  return /url|uri|endpoint|href/i.test(key);\n}\n\nfunction isPlainObject(value: object): boolean {\n  const proto = Object.getPrototypeOf(value) as unknown;\n  return proto === Object.prototype || proto === null;\n}\n\nfunction safeDecode(value: string): string {\n  try {\n    return decodeURIComponent(value.replaceAll('+', ' '));\n  } catch {\n    return value;\n  }\n}\n\n/** Absolute URL: `scheme://host` only. Relative or unparseable: path kept, query and fragment cut. */\nexport function redactUrl(raw: string | URL): string {\n  if (typeof raw !== 'string') return `${raw.protocol}//${raw.host}`;\n  if (SCHEME_PREFIX.test(raw)) {\n    try {\n      const url = new URL(raw);\n      return `${url.protocol}//${url.host}`;\n    } catch {\n      return REDACTED;\n    }\n  }\n  return raw.split(/[?#]/, 1)[0] ?? '';\n}\n\nfunction redactHeaders(headers: unknown): unknown {\n  if (!headers || typeof headers !== 'object') return headers;\n  return Object.fromEntries(Object.keys(headers).map((name) => [name, REDACTED]));\n}\n\n/** Redacted deep copy of a config-like value. Never throws, never returns a secret. */\nexport function redactConfig(value: unknown, depth = 0, key = ''): unknown {\n  if (value === null || value === undefined) return value;\n  if (typeof value === 'string') {\n    return SCHEME_PREFIX.test(value) || isUrlKey(key) ? redactUrl(value) : value;\n  }\n  if (typeof value === 'number' || typeof value === 'boolean') return value;\n  if (typeof value === 'function') return '[Function]';\n  if (typeof value !== 'object') return '[Unserializable]';\n  if (typeof URL !== 'undefined' && value instanceof URL) return redactUrl(value);\n  if (Array.isArray(value)) {\n    return depth >= MAX_DEPTH ? '[Array]' : value.map((v) => redactConfig(v, depth + 1, key));\n  }\n  if (!isPlainObject(value) || depth >= MAX_DEPTH)\n    return `[${value.constructor?.name ?? 'Object'}]`;\n  const out: Record<string, unknown> = {};\n  for (const [name, inner] of Object.entries(value)) {\n    if (isSecretKey(name)) assignOwn(out, name, inner === undefined ? undefined : REDACTED);\n    else if (name.toLowerCase() === 'headers') assignOwn(out, name, redactHeaders(inner));\n    else assignOwn(out, name, redactConfig(inner, depth + 1, name));\n  }\n  return out;\n}\n\n// ── Secret protection ───────────────────────────────────────────────────────\n\nconst hiddenKeys = new WeakMap<object, Set<string>>();\nconst hiddenValues = new WeakMap<object, Map<string, unknown>>();\n\nfunction viewOf(target: object): Record<string, unknown> {\n  const hidden = hiddenKeys.get(target) ?? new Set<string>();\n  const values = hiddenValues.get(target);\n  const view: Record<string, unknown> = { class: target.constructor?.name };\n  for (const key of new Set([...Object.keys(target), ...hidden])) {\n    const inner = hidden.has(key) ? values?.get(key) : (target as Record<string, unknown>)[key];\n    if (isSecretKey(key)) view[key] = inner === undefined ? undefined : REDACTED;\n    else if (key.toLowerCase() === 'headers') view[key] = redactHeaders(inner);\n    else if (\n      inner !== null &&\n      typeof inner === 'object' &&\n      !hidden.has(key) &&\n      !(inner instanceof URL)\n    ) {\n      view[key] = '[Object]';\n    } else if (hidden.has(key) && typeof inner === 'string' && !isUrlKey(key)) {\n      view[key] = REDACTED;\n    } else view[key] = redactConfig(inner, 0, key);\n  }\n  return view;\n}\n\n// One toJSON / inspect function for every protected object. It finds the protected\n// object up the prototype chain, so an Object.create() of one shows the same view.\nfunction protectedOwner(value: object): object {\n  let target: object | null = value;\n  while (target !== null && !hiddenKeys.has(target))\n    target = Object.getPrototypeOf(target) as object | null;\n  return target ?? value;\n}\n\nfunction protectedView(this: object): Record<string, unknown> {\n  return viewOf(protectedOwner(this));\n}\nconst VIEW_DESCRIPTOR: PropertyDescriptor = {\n  value: protectedView,\n  enumerable: false,\n  configurable: true,\n};\n\n/**\n * Hides `keys` on `target` (assigned or not yet) and gives it a redacted `toJSON()` /\n * inspect view. Fields stay readable and writable. Safe to call more than once.\n * Throws when the target cannot carry the protection (frozen or sealed), instead of\n * silently leaving the secret enumerable.\n */\nexport function protectSecrets(target: object, keys: readonly string[]): void {\n  if (!Object.isExtensible(target)) {\n    throw new TypeError(\n      `protectSecrets: ${target.constructor?.name ?? 'object'} is not extensible`\n    );\n  }\n  let hidden = hiddenKeys.get(target);\n  let values = hiddenValues.get(target);\n  if (!hidden || !values) {\n    hidden = new Set();\n    values = new Map();\n    hiddenKeys.set(target, hidden);\n    hiddenValues.set(target, values);\n    Object.defineProperty(target, 'toJSON', VIEW_DESCRIPTOR);\n    Object.defineProperty(target, INSPECT_CUSTOM, VIEW_DESCRIPTOR);\n  }\n  const store = values;\n  for (const key of keys) {\n    if (hidden.has(key)) continue;\n    const desc = Object.getOwnPropertyDescriptor(target, key);\n    if (desc && !desc.configurable) {\n      throw new TypeError(`protectSecrets: \"${key}\" is not configurable`);\n    }\n    if (desc && 'value' in desc) store.set(key, desc.value);\n    hidden.add(key);\n    Object.defineProperty(target, key, {\n      enumerable: false,\n      configurable: true,\n      get: () => store.get(key),\n      set: (next: unknown) => void store.set(key, next),\n    });\n  }\n}\n\n// ── Scrubbing error text ────────────────────────────────────────────────────\n\n/** The raw, decoded and percent-encoded spellings of a secret. */\nfunction variantsOf(secret: string): string[] {\n  return [secret, safeDecode(secret), encodeURIComponent(secret), encodeURI(secret)];\n}\n\n/** Secret parts of a URL string: the password and the values of sensitive query parameters. */\nexport function urlSecrets(raw: string | URL): string[] {\n  const text = typeof raw === 'string' ? raw : raw.href;\n  const out: string[] = [];\n  const userinfo = new RegExp(USERINFO.source, 'i').exec(text);\n  if (userinfo) {\n    const info = text.slice(userinfo[1]!.length, userinfo.index + userinfo[0].length - 1);\n    const colon = info.indexOf(':');\n    if (colon !== -1) out.push(info.slice(colon + 1));\n  }\n  const queryStart = text.indexOf('?');\n  if (queryStart !== -1) {\n    const query = text.slice(queryStart + 1).split('#', 1)[0] ?? '';\n    for (const pair of query.split('&')) {\n      const eq = pair.indexOf('=');\n      if (eq > 0 && QUERY_NAMES.has(normalizeName(safeDecode(pair.slice(0, eq))))) {\n        out.push(pair.slice(eq + 1));\n      }\n    }\n  }\n  return out.flatMap(variantsOf);\n}\n\n/** Every secret string held in a config-like value: secret-keyed values, header values, URL secrets. */\nexport function collectSecrets(value: unknown, depth = 0, key = ''): string[] {\n  if (typeof value === 'string') {\n    if (isSecretKey(key)) return [value];\n    return SCHEME_PREFIX.test(value) || isUrlKey(key) ? urlSecrets(value) : [];\n  }\n  if (!value || typeof value !== 'object' || depth > MAX_DEPTH) return [];\n  if (typeof URL !== 'undefined' && value instanceof URL) return urlSecrets(value);\n  if (Array.isArray(value)) return value.flatMap((v) => collectSecrets(v, depth + 1, key));\n  if (!isPlainObject(value)) return [];\n  const isHeaders = key.toLowerCase() === 'headers';\n  return Object.entries(value).flatMap(([name, inner]) => {\n    if (isHeaders && typeof inner === 'string') return [inner];\n    if (isSecretKey(name) && inner !== null && typeof inner === 'object') {\n      return collectSecrets(inner, depth + 1, 'secret');\n    }\n    return collectSecrets(inner, depth + 1, name);\n  });\n}\n\n/** Replaces URL userinfo and every spelling of the given secret values in `text`. */\nexport function scrubSecrets(text: string, secrets: readonly (string | undefined)[]): string {\n  let out = text.replace(USERINFO, `$1${REDACTED}@`);\n  const all = new Set(\n    secrets.flatMap((s) => (s && s.length >= MIN_SECRET_LENGTH ? variantsOf(s) : []))\n  );\n  for (const secret of [...all].sort((a, b) => b.length - a.length)) {\n    if (secret.length >= MIN_SECRET_LENGTH) out = out.split(secret).join(REDACTED);\n  }\n  return out;\n}\n\n/** Scrubs message, stack and the cause chain of `err` in place; returns it. */\nexport function scrubError<T>(err: T, secrets: readonly (string | undefined)[], depth = 0): T {\n  if (!(err instanceof Error) || depth > 3) return err;\n  try {\n    err.message = scrubSecrets(err.message, secrets);\n    if (err.stack) err.stack = scrubSecrets(err.stack, secrets);\n    scrubError((err as { cause?: unknown }).cause, secrets, depth + 1);\n  } catch {\n    /* frozen error: leave as is */\n  }\n  return err;\n}\n\n/** A `.catch()` handler that scrubs the secrets from the error, then rethrows it. */\nexport function scrubbing(secrets: () => (string | undefined)[]): (err: unknown) => never {\n  return (err) => {\n    throw scrubError(err, secrets());\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AAkBA,MAAa,WAAW;AAExB,MAAM,iBAAiB,OAAO,IAAI,4BAA4B;AAC9D,MAAM,YAAY;AAClB,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;;AAEtB,MAAM,WAAW;AAEjB,SAAS,cAAc,MAAsB;CAC3C,OAAO,KAAK,YAAY,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,WAAW,KAAK,EAAE;AAClE;AAEA,MAAM,eAAe,CAAC,GAAG,qBAAqB,GAAG,6BAA6B,CAAC,CAAC,IAAI,aAAa;AACjG,MAAM,cAAc,IAAI,IAAI,4BAA4B,IAAI,aAAa,CAAC;;AAG1E,SAAS,YAAY,KAAsB;CACzC,MAAM,OAAO,cAAc,GAAG;CAC9B,OAAO,aAAa,MAAM,MAAM,SAAS,KAAM,EAAE,UAAU,KAAK,KAAK,SAAS,CAAC,CAAE;AACnF;AAEA,SAAS,SAAS,KAAsB;CACtC,OAAO,yBAAyB,KAAK,GAAG;AAC1C;AAEA,SAAS,cAAc,OAAwB;CAC7C,MAAM,QAAQ,OAAO,eAAe,KAAK;CACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,SAAS,WAAW,OAAuB;CACzC,IAAI;EACF,OAAO,mBAAmB,MAAM,WAAW,KAAK,GAAG,CAAC;CACtD,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,UAAU,KAA2B;CACnD,IAAI,OAAO,QAAQ,UAAU,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CAC5D,IAAI,cAAc,KAAK,GAAG,GACxB,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,GAAG;EACvB,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN,OAAO;CACT;CAEF,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,MAAM;AACpC;AAEA,SAAS,cAAc,SAA2B;CAChD,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU,OAAO;CACpD,OAAO,OAAO,YAAY,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,QAAQ,CAAC,CAAC;AAChF;;AAGA,SAAgB,aAAa,OAAgB,QAAQ,GAAG,MAAM,IAAa;;CACzE,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,OAAO;CAClD,IAAI,OAAO,UAAU,UACnB,OAAO,cAAc,KAAK,KAAK,KAAK,SAAS,GAAG,IAAI,UAAU,KAAK,IAAI;CAEzE,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW,OAAO;CACpE,IAAI,OAAO,UAAU,YAAY,OAAO;CACxC,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,OAAO,QAAQ,eAAe,iBAAiB,KAAK,OAAO,UAAU,KAAK;CAC9E,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,SAAS,YAAY,YAAY,MAAM,KAAK,MAAM,aAAa,GAAG,QAAQ,GAAG,GAAG,CAAC;CAE1F,IAAI,CAAC,cAAc,KAAK,KAAK,SAAS,WACpC,OAAO,MAAA,qBAAI,MAAM,iBAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAa,SAAQ,SAAS;CACjD,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,GAC9C,IAAI,YAAY,IAAI,GAAG,UAAU,KAAK,MAAM,UAAU,KAAA,IAAY,KAAA,IAAY,QAAQ;MACjF,IAAI,KAAK,YAAY,MAAM,WAAW,UAAU,KAAK,MAAM,cAAc,KAAK,CAAC;MAC/E,UAAU,KAAK,MAAM,aAAa,OAAO,QAAQ,GAAG,IAAI,CAAC;CAEhE,OAAO;AACT;AAIA,MAAM,6BAAa,IAAI,QAA6B;AACpD,MAAM,+BAAe,IAAI,QAAsC;AAE/D,SAAS,OAAO,QAAyC;;CACvD,MAAM,SAAS,WAAW,IAAI,MAAM,qBAAK,IAAI,IAAY;CACzD,MAAM,SAAS,aAAa,IAAI,MAAM;CACtC,MAAM,OAAgC,EAAE,QAAA,sBAAO,OAAO,iBAAA,QAAA,wBAAA,KAAA,IAAA,KAAA,IAAA,oBAAa,KAAK;CACxE,KAAK,MAAM,uBAAO,IAAI,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;EAC9D,MAAM,QAAQ,OAAO,IAAI,GAAG,IAAA,WAAA,QAAA,WAAA,KAAA,IAAA,KAAA,IAAI,OAAQ,IAAI,GAAG,IAAK,OAAmC;EACvF,IAAI,YAAY,GAAG,GAAG,KAAK,OAAO,UAAU,KAAA,IAAY,KAAA,IAAY;OAC/D,IAAI,IAAI,YAAY,MAAM,WAAW,KAAK,OAAO,cAAc,KAAK;OACpE,IACH,UAAU,QACV,OAAO,UAAU,YACjB,CAAC,OAAO,IAAI,GAAG,KACf,EAAE,iBAAiB,MAEnB,KAAK,OAAO;OACP,IAAI,OAAO,IAAI,GAAG,KAAK,OAAO,UAAU,YAAY,CAAC,SAAS,GAAG,GACtE,KAAK,OAAO;OACP,KAAK,OAAO,aAAa,OAAO,GAAG,GAAG;CAC/C;CACA,OAAO;AACT;AAIA,SAAS,eAAe,OAAuB;CAC7C,IAAI,SAAwB;CAC5B,OAAO,WAAW,QAAQ,CAAC,WAAW,IAAI,MAAM,GAC9C,SAAS,OAAO,eAAe,MAAM;CACvC,OAAO,UAAU;AACnB;AAEA,SAAS,gBAAqD;CAC5D,OAAO,OAAO,eAAe,IAAI,CAAC;AACpC;AACA,MAAM,kBAAsC;CAC1C,OAAO;CACP,YAAY;CACZ,cAAc;AAChB;;;;;;;AAQA,SAAgB,eAAe,QAAgB,MAA+B;CAC5E,IAAI,CAAC,OAAO,aAAa,MAAM,GAAG;;EAChC,MAAM,IAAI,UACR,qBAAA,uBAAmB,OAAO,iBAAA,QAAA,yBAAA,KAAA,IAAA,KAAA,IAAA,qBAAa,SAAQ,SAAS,mBAC1D;CACF;CACA,IAAI,SAAS,WAAW,IAAI,MAAM;CAClC,IAAI,SAAS,aAAa,IAAI,MAAM;CACpC,IAAI,CAAC,UAAU,CAAC,QAAQ;EACtB,yBAAS,IAAI,IAAI;EACjB,yBAAS,IAAI,IAAI;EACjB,WAAW,IAAI,QAAQ,MAAM;EAC7B,aAAa,IAAI,QAAQ,MAAM;EAC/B,OAAO,eAAe,QAAQ,UAAU,eAAe;EACvD,OAAO,eAAe,QAAQ,gBAAgB,eAAe;CAC/D;CACA,MAAM,QAAQ;CACd,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,OAAO,IAAI,GAAG,GAAG;EACrB,MAAM,OAAO,OAAO,yBAAyB,QAAQ,GAAG;EACxD,IAAI,QAAQ,CAAC,KAAK,cAChB,MAAM,IAAI,UAAU,oBAAoB,IAAI,sBAAsB;EAEpE,IAAI,QAAQ,WAAW,MAAM,MAAM,IAAI,KAAK,KAAK,KAAK;EACtD,OAAO,IAAI,GAAG;EACd,OAAO,eAAe,QAAQ,KAAK;GACjC,YAAY;GACZ,cAAc;GACd,WAAW,MAAM,IAAI,GAAG;GACxB,MAAM,SAAkB,KAAK,MAAM,IAAI,KAAK,IAAI;EAClD,CAAC;CACH;AACF;;AAKA,SAAS,WAAW,QAA0B;CAC5C,OAAO;EAAC;EAAQ,WAAW,MAAM;EAAG,mBAAmB,MAAM;EAAG,UAAU,MAAM;CAAC;AACnF;;AAGA,SAAgB,WAAW,KAA6B;CACtD,MAAM,OAAO,OAAO,QAAQ,WAAW,MAAM,IAAI;CACjD,MAAM,MAAgB,CAAC;CACvB,MAAM,WAAW,IAAI,OAAO,SAAS,QAAQ,GAAG,CAAC,CAAC,KAAK,IAAI;CAC3D,IAAI,UAAU;EACZ,MAAM,OAAO,KAAK,MAAM,SAAS,EAAE,CAAE,QAAQ,SAAS,QAAQ,SAAS,EAAE,CAAC,SAAS,CAAC;EACpF,MAAM,QAAQ,KAAK,QAAQ,GAAG;EAC9B,IAAI,UAAU,IAAI,IAAI,KAAK,KAAK,MAAM,QAAQ,CAAC,CAAC;CAClD;CACA,MAAM,aAAa,KAAK,QAAQ,GAAG;CACnC,IAAI,eAAe,IAAI;EACrB,MAAM,QAAQ,KAAK,MAAM,aAAa,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM;EAC7D,KAAK,MAAM,QAAQ,MAAM,MAAM,GAAG,GAAG;GACnC,MAAM,KAAK,KAAK,QAAQ,GAAG;GAC3B,IAAI,KAAK,KAAK,YAAY,IAAI,cAAc,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GACxE,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC;EAE/B;CACF;CACA,OAAO,IAAI,QAAQ,UAAU;AAC/B;;AAGA,SAAgB,eAAe,OAAgB,QAAQ,GAAG,MAAM,IAAc;CAC5E,IAAI,OAAO,UAAU,UAAU;EAC7B,IAAI,YAAY,GAAG,GAAG,OAAO,CAAC,KAAK;EACnC,OAAO,cAAc,KAAK,KAAK,KAAK,SAAS,GAAG,IAAI,WAAW,KAAK,IAAI,CAAC;CAC3E;CACA,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,QAAQ,WAAW,OAAO,CAAC;CACtE,IAAI,OAAO,QAAQ,eAAe,iBAAiB,KAAK,OAAO,WAAW,KAAK;CAC/E,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,SAAS,MAAM,eAAe,GAAG,QAAQ,GAAG,GAAG,CAAC;CACvF,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,CAAC;CACnC,MAAM,YAAY,IAAI,YAAY,MAAM;CACxC,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,WAAW;EACtD,IAAI,aAAa,OAAO,UAAU,UAAU,OAAO,CAAC,KAAK;EACzD,IAAI,YAAY,IAAI,KAAK,UAAU,QAAQ,OAAO,UAAU,UAC1D,OAAO,eAAe,OAAO,QAAQ,GAAG,QAAQ;EAElD,OAAO,eAAe,OAAO,QAAQ,GAAG,IAAI;CAC9C,CAAC;AACH;;AAGA,SAAgB,aAAa,MAAc,SAAkD;CAC3F,IAAI,MAAM,KAAK,QAAQ,UAAU,KAAK,SAAS,EAAE;CACjD,MAAM,MAAM,IAAI,IACd,QAAQ,SAAS,MAAO,KAAK,EAAE,UAAU,oBAAoB,WAAW,CAAC,IAAI,CAAC,CAAE,CAClF;CACA,KAAK,MAAM,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAC9D,IAAI,OAAO,UAAU,mBAAmB,MAAM,IAAI,MAAM,MAAM,CAAC,CAAC,KAAK,QAAQ;CAE/E,OAAO;AACT;;AAGA,SAAgB,WAAc,KAAQ,SAA0C,QAAQ,GAAM;CAC5F,IAAI,EAAE,eAAe,UAAU,QAAQ,GAAG,OAAO;CACjD,IAAI;EACF,IAAI,UAAU,aAAa,IAAI,SAAS,OAAO;EAC/C,IAAI,IAAI,OAAO,IAAI,QAAQ,aAAa,IAAI,OAAO,OAAO;EAC1D,WAAY,IAA4B,OAAO,SAAS,QAAQ,CAAC;CACnE,QAAQ,CAER;CACA,OAAO;AACT;;AAGA,SAAgB,UAAU,SAAgE;CACxF,QAAQ,QAAQ;EACd,MAAM,WAAW,KAAK,QAAQ,CAAC;CACjC;AACF"}

package/dist/secret-config-OqmIPmpV.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"secret-config-OqmIPmpV.js","names":["SENSITIVE_KEY_NAMES","TRANSPORT_CONFIG_SECRET_NAMES","DEFAULT_REDACT_QUERY_PARAMS"],"sources":["../src/transports/secret-config.ts"],"sourcesContent":["/**\n * Keeps credentials out of serialized transport output and error text.\n *\n * `protectSecrets()` replaces each listed field with a non-enumerable accessor backed\n * by a WeakMap, whether or not the field is assigned yet, so later assignments (a\n * connection opened on first write, a refreshed token) stay hidden too. It also\n * installs `toJSON()` and a Node inspect hook returning a redacted view: scalar\n * fields stay for debugging, secret-looking keys become '[REDACTED]', URLs lose\n * userinfo, query and fragment. No Node imports, so browser bundles can use it.\n */\n\nimport { assignOwn } from '../utils/own-property';\nimport {\n  DEFAULT_REDACT_QUERY_PARAMS,\n  SENSITIVE_KEY_NAMES,\n  TRANSPORT_CONFIG_SECRET_NAMES,\n} from '../utils/sensitive-names';\n\nexport const REDACTED = '[REDACTED]';\n\nconst INSPECT_CUSTOM = Symbol.for('nodejs.util.inspect.custom');\nconst MAX_DEPTH = 4;\nconst MIN_SECRET_LENGTH = 4;\nconst SCHEME_PREFIX = /^[a-z][a-z0-9+.-]*:\\/\\//i;\n/** `scheme://userinfo@`: userinfo runs to the LAST `@` before the path, so `p@ss` is covered. */\nconst USERINFO = /(\\b[a-z][a-z0-9+.-]*:\\/\\/)[^\\s/?#]*@/gi;\n\nfunction normalizeName(name: string): string {\n  return name.toLowerCase().replaceAll('-', '').replaceAll('_', '');\n}\n\nconst SECRET_NAMES = [...SENSITIVE_KEY_NAMES, ...TRANSPORT_CONFIG_SECRET_NAMES].map(normalizeName);\nconst QUERY_NAMES = new Set(DEFAULT_REDACT_QUERY_PARAMS.map(normalizeName));\n\n/** Exact match for short names (`key`, `pfx`), suffix match for longer ones (`azureClientSecret`). */\nfunction isSecretKey(key: string): boolean {\n  const name = normalizeName(key);\n  return SECRET_NAMES.some((n) => name === n || (n.length >= 5 && name.endsWith(n)));\n}\n\nfunction isUrlKey(key: string): boolean {\n  return /url|uri|endpoint|href/i.test(key);\n}\n\nfunction isPlainObject(value: object): boolean {\n  const proto = Object.getPrototypeOf(value) as unknown;\n  return proto === Object.prototype || proto === null;\n}\n\nfunction safeDecode(value: string): string {\n  try {\n    return decodeURIComponent(value.replaceAll('+', ' '));\n  } catch {\n    return value;\n  }\n}\n\n/** Absolute URL: `scheme://host` only. Relative or unparseable: path kept, query and fragment cut. */\nexport function redactUrl(raw: string | URL): string {\n  if (typeof raw !== 'string') return `${raw.protocol}//${raw.host}`;\n  if (SCHEME_PREFIX.test(raw)) {\n    try {\n      const url = new URL(raw);\n      return `${url.protocol}//${url.host}`;\n    } catch {\n      return REDACTED;\n    }\n  }\n  return raw.split(/[?#]/, 1)[0] ?? '';\n}\n\nfunction redactHeaders(headers: unknown): unknown {\n  if (!headers || typeof headers !== 'object') return headers;\n  return Object.fromEntries(Object.keys(headers).map((name) => [name, REDACTED]));\n}\n\n/** Redacted deep copy of a config-like value. Never throws, never returns a secret. */\nexport function redactConfig(value: unknown, depth = 0, key = ''): unknown {\n  if (value === null || value === undefined) return value;\n  if (typeof value === 'string') {\n    return SCHEME_PREFIX.test(value) || isUrlKey(key) ? redactUrl(value) : value;\n  }\n  if (typeof value === 'number' || typeof value === 'boolean') return value;\n  if (typeof value === 'function') return '[Function]';\n  if (typeof value !== 'object') return '[Unserializable]';\n  if (typeof URL !== 'undefined' && value instanceof URL) return redactUrl(value);\n  if (Array.isArray(value)) {\n    return depth >= MAX_DEPTH ? '[Array]' : value.map((v) => redactConfig(v, depth + 1, key));\n  }\n  if (!isPlainObject(value) || depth >= MAX_DEPTH)\n    return `[${value.constructor?.name ?? 'Object'}]`;\n  const out: Record<string, unknown> = {};\n  for (const [name, inner] of Object.entries(value)) {\n    if (isSecretKey(name)) assignOwn(out, name, inner === undefined ? undefined : REDACTED);\n    else if (name.toLowerCase() === 'headers') assignOwn(out, name, redactHeaders(inner));\n    else assignOwn(out, name, redactConfig(inner, depth + 1, name));\n  }\n  return out;\n}\n\n// ── Secret protection ───────────────────────────────────────────────────────\n\nconst hiddenKeys = new WeakMap<object, Set<string>>();\nconst hiddenValues = new WeakMap<object, Map<string, unknown>>();\n\nfunction viewOf(target: object): Record<string, unknown> {\n  const hidden = hiddenKeys.get(target) ?? new Set<string>();\n  const values = hiddenValues.get(target);\n  const view: Record<string, unknown> = { class: target.constructor?.name };\n  for (const key of new Set([...Object.keys(target), ...hidden])) {\n    const inner = hidden.has(key) ? values?.get(key) : (target as Record<string, unknown>)[key];\n    if (isSecretKey(key)) view[key] = inner === undefined ? undefined : REDACTED;\n    else if (key.toLowerCase() === 'headers') view[key] = redactHeaders(inner);\n    else if (\n      inner !== null &&\n      typeof inner === 'object' &&\n      !hidden.has(key) &&\n      !(inner instanceof URL)\n    ) {\n      view[key] = '[Object]';\n    } else if (hidden.has(key) && typeof inner === 'string' && !isUrlKey(key)) {\n      view[key] = REDACTED;\n    } else view[key] = redactConfig(inner, 0, key);\n  }\n  return view;\n}\n\n// One toJSON / inspect function for every protected object. It finds the protected\n// object up the prototype chain, so an Object.create() of one shows the same view.\nfunction protectedOwner(value: object): object {\n  let target: object | null = value;\n  while (target !== null && !hiddenKeys.has(target))\n    target = Object.getPrototypeOf(target) as object | null;\n  return target ?? value;\n}\n\nfunction protectedView(this: object): Record<string, unknown> {\n  return viewOf(protectedOwner(this));\n}\nconst VIEW_DESCRIPTOR: PropertyDescriptor = {\n  value: protectedView,\n  enumerable: false,\n  configurable: true,\n};\n\n/**\n * Hides `keys` on `target` (assigned or not yet) and gives it a redacted `toJSON()` /\n * inspect view. Fields stay readable and writable. Safe to call more than once.\n * Throws when the target cannot carry the protection (frozen or sealed), instead of\n * silently leaving the secret enumerable.\n */\nexport function protectSecrets(target: object, keys: readonly string[]): void {\n  if (!Object.isExtensible(target)) {\n    throw new TypeError(\n      `protectSecrets: ${target.constructor?.name ?? 'object'} is not extensible`\n    );\n  }\n  let hidden = hiddenKeys.get(target);\n  let values = hiddenValues.get(target);\n  if (!hidden || !values) {\n    hidden = new Set();\n    values = new Map();\n    hiddenKeys.set(target, hidden);\n    hiddenValues.set(target, values);\n    Object.defineProperty(target, 'toJSON', VIEW_DESCRIPTOR);\n    Object.defineProperty(target, INSPECT_CUSTOM, VIEW_DESCRIPTOR);\n  }\n  const store = values;\n  for (const key of keys) {\n    if (hidden.has(key)) continue;\n    const desc = Object.getOwnPropertyDescriptor(target, key);\n    if (desc && !desc.configurable) {\n      throw new TypeError(`protectSecrets: \"${key}\" is not configurable`);\n    }\n    if (desc && 'value' in desc) store.set(key, desc.value);\n    hidden.add(key);\n    Object.defineProperty(target, key, {\n      enumerable: false,\n      configurable: true,\n      get: () => store.get(key),\n      set: (next: unknown) => void store.set(key, next),\n    });\n  }\n}\n\n// ── Scrubbing error text ────────────────────────────────────────────────────\n\n/** The raw, decoded and percent-encoded spellings of a secret. */\nfunction variantsOf(secret: string): string[] {\n  return [secret, safeDecode(secret), encodeURIComponent(secret), encodeURI(secret)];\n}\n\n/** Secret parts of a URL string: the password and the values of sensitive query parameters. */\nexport function urlSecrets(raw: string | URL): string[] {\n  const text = typeof raw === 'string' ? raw : raw.href;\n  const out: string[] = [];\n  const userinfo = new RegExp(USERINFO.source, 'i').exec(text);\n  if (userinfo) {\n    const info = text.slice(userinfo[1]!.length, userinfo.index + userinfo[0].length - 1);\n    const colon = info.indexOf(':');\n    if (colon !== -1) out.push(info.slice(colon + 1));\n  }\n  const queryStart = text.indexOf('?');\n  if (queryStart !== -1) {\n    const query = text.slice(queryStart + 1).split('#', 1)[0] ?? '';\n    for (const pair of query.split('&')) {\n      const eq = pair.indexOf('=');\n      if (eq > 0 && QUERY_NAMES.has(normalizeName(safeDecode(pair.slice(0, eq))))) {\n        out.push(pair.slice(eq + 1));\n      }\n    }\n  }\n  return out.flatMap(variantsOf);\n}\n\n/** Every secret string held in a config-like value: secret-keyed values, header values, URL secrets. */\nexport function collectSecrets(value: unknown, depth = 0, key = ''): string[] {\n  if (typeof value === 'string') {\n    if (isSecretKey(key)) return [value];\n    return SCHEME_PREFIX.test(value) || isUrlKey(key) ? urlSecrets(value) : [];\n  }\n  if (!value || typeof value !== 'object' || depth > MAX_DEPTH) return [];\n  if (typeof URL !== 'undefined' && value instanceof URL) return urlSecrets(value);\n  if (Array.isArray(value)) return value.flatMap((v) => collectSecrets(v, depth + 1, key));\n  if (!isPlainObject(value)) return [];\n  const isHeaders = key.toLowerCase() === 'headers';\n  return Object.entries(value).flatMap(([name, inner]) => {\n    if (isHeaders && typeof inner === 'string') return [inner];\n    if (isSecretKey(name) && inner !== null && typeof inner === 'object') {\n      return collectSecrets(inner, depth + 1, 'secret');\n    }\n    return collectSecrets(inner, depth + 1, name);\n  });\n}\n\n/** Replaces URL userinfo and every spelling of the given secret values in `text`. */\nexport function scrubSecrets(text: string, secrets: readonly (string | undefined)[]): string {\n  let out = text.replace(USERINFO, `$1${REDACTED}@`);\n  const all = new Set(\n    secrets.flatMap((s) => (s && s.length >= MIN_SECRET_LENGTH ? variantsOf(s) : []))\n  );\n  for (const secret of [...all].sort((a, b) => b.length - a.length)) {\n    if (secret.length >= MIN_SECRET_LENGTH) out = out.split(secret).join(REDACTED);\n  }\n  return out;\n}\n\n/** Scrubs message, stack and the cause chain of `err` in place; returns it. */\nexport function scrubError<T>(err: T, secrets: readonly (string | undefined)[], depth = 0): T {\n  if (!(err instanceof Error) || depth > 3) return err;\n  try {\n    err.message = scrubSecrets(err.message, secrets);\n    if (err.stack) err.stack = scrubSecrets(err.stack, secrets);\n    scrubError((err as { cause?: unknown }).cause, secrets, depth + 1);\n  } catch {\n    /* frozen error: leave as is */\n  }\n  return err;\n}\n\n/** A `.catch()` handler that scrubs the secrets from the error, then rethrows it. */\nexport function scrubbing(secrets: () => (string | undefined)[]): (err: unknown) => never {\n  return (err) => {\n    throw scrubError(err, secrets());\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,MAAa,WAAW;AAExB,MAAM,iBAAiB,OAAO,IAAI,4BAA4B;AAC9D,MAAM,YAAY;AAClB,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;;AAEtB,MAAM,WAAW;AAEjB,SAAS,cAAc,MAAsB;CAC3C,OAAO,KAAK,YAAY,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,WAAW,KAAK,EAAE;AAClE;AAEA,MAAM,eAAe,CAAC,GAAGA,wBAAAA,qBAAqB,GAAGC,wBAAAA,6BAA6B,CAAC,CAAC,IAAI,aAAa;AACjG,MAAM,cAAc,IAAI,IAAIC,wBAAAA,4BAA4B,IAAI,aAAa,CAAC;;AAG1E,SAAS,YAAY,KAAsB;CACzC,MAAM,OAAO,cAAc,GAAG;CAC9B,OAAO,aAAa,MAAM,MAAM,SAAS,KAAM,EAAE,UAAU,KAAK,KAAK,SAAS,CAAC,CAAE;AACnF;AAEA,SAAS,SAAS,KAAsB;CACtC,OAAO,yBAAyB,KAAK,GAAG;AAC1C;AAEA,SAAS,cAAc,OAAwB;CAC7C,MAAM,QAAQ,OAAO,eAAe,KAAK;CACzC,OAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,SAAS,WAAW,OAAuB;CACzC,IAAI;EACF,OAAO,mBAAmB,MAAM,WAAW,KAAK,GAAG,CAAC;CACtD,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,UAAU,KAA2B;CACnD,IAAI,OAAO,QAAQ,UAAU,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CAC5D,IAAI,cAAc,KAAK,GAAG,GACxB,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,GAAG;EACvB,OAAO,GAAG,IAAI,SAAS,IAAI,IAAI;CACjC,QAAQ;EACN,OAAO;CACT;CAEF,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,MAAM;AACpC;AAEA,SAAS,cAAc,SAA2B;CAChD,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU,OAAO;CACpD,OAAO,OAAO,YAAY,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,QAAQ,CAAC,CAAC;AAChF;;AAGA,SAAgB,aAAa,OAAgB,QAAQ,GAAG,MAAM,IAAa;;CACzE,IAAI,UAAU,QAAQ,UAAU,KAAA,GAAW,OAAO;CAClD,IAAI,OAAO,UAAU,UACnB,OAAO,cAAc,KAAK,KAAK,KAAK,SAAS,GAAG,IAAI,UAAU,KAAK,IAAI;CAEzE,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW,OAAO;CACpE,IAAI,OAAO,UAAU,YAAY,OAAO;CACxC,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,OAAO,QAAQ,eAAe,iBAAiB,KAAK,OAAO,UAAU,KAAK;CAC9E,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,SAAS,YAAY,YAAY,MAAM,KAAK,MAAM,aAAa,GAAG,QAAQ,GAAG,GAAG,CAAC;CAE1F,IAAI,CAAC,cAAc,KAAK,KAAK,SAAS,WACpC,OAAO,MAAA,qBAAI,MAAM,iBAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAa,SAAQ,SAAS;CACjD,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,GAC9C,IAAI,YAAY,IAAI,GAAG,qBAAA,UAAU,KAAK,MAAM,UAAU,KAAA,IAAY,KAAA,IAAY,QAAQ;MACjF,IAAI,KAAK,YAAY,MAAM,WAAW,qBAAA,UAAU,KAAK,MAAM,cAAc,KAAK,CAAC;MAC/E,qBAAA,UAAU,KAAK,MAAM,aAAa,OAAO,QAAQ,GAAG,IAAI,CAAC;CAEhE,OAAO;AACT;AAIA,MAAM,6BAAa,IAAI,QAA6B;AACpD,MAAM,+BAAe,IAAI,QAAsC;AAE/D,SAAS,OAAO,QAAyC;;CACvD,MAAM,SAAS,WAAW,IAAI,MAAM,qBAAK,IAAI,IAAY;CACzD,MAAM,SAAS,aAAa,IAAI,MAAM;CACtC,MAAM,OAAgC,EAAE,QAAA,sBAAO,OAAO,iBAAA,QAAA,wBAAA,KAAA,IAAA,KAAA,IAAA,oBAAa,KAAK;CACxE,KAAK,MAAM,uBAAO,IAAI,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;EAC9D,MAAM,QAAQ,OAAO,IAAI,GAAG,IAAA,WAAA,QAAA,WAAA,KAAA,IAAA,KAAA,IAAI,OAAQ,IAAI,GAAG,IAAK,OAAmC;EACvF,IAAI,YAAY,GAAG,GAAG,KAAK,OAAO,UAAU,KAAA,IAAY,KAAA,IAAY;OAC/D,IAAI,IAAI,YAAY,MAAM,WAAW,KAAK,OAAO,cAAc,KAAK;OACpE,IACH,UAAU,QACV,OAAO,UAAU,YACjB,CAAC,OAAO,IAAI,GAAG,KACf,EAAE,iBAAiB,MAEnB,KAAK,OAAO;OACP,IAAI,OAAO,IAAI,GAAG,KAAK,OAAO,UAAU,YAAY,CAAC,SAAS,GAAG,GACtE,KAAK,OAAO;OACP,KAAK,OAAO,aAAa,OAAO,GAAG,GAAG;CAC/C;CACA,OAAO;AACT;AAIA,SAAS,eAAe,OAAuB;CAC7C,IAAI,SAAwB;CAC5B,OAAO,WAAW,QAAQ,CAAC,WAAW,IAAI,MAAM,GAC9C,SAAS,OAAO,eAAe,MAAM;CACvC,OAAO,UAAU;AACnB;AAEA,SAAS,gBAAqD;CAC5D,OAAO,OAAO,eAAe,IAAI,CAAC;AACpC;AACA,MAAM,kBAAsC;CAC1C,OAAO;CACP,YAAY;CACZ,cAAc;AAChB;;;;;;;AAQA,SAAgB,eAAe,QAAgB,MAA+B;CAC5E,IAAI,CAAC,OAAO,aAAa,MAAM,GAAG;;EAChC,MAAM,IAAI,UACR,qBAAA,uBAAmB,OAAO,iBAAA,QAAA,yBAAA,KAAA,IAAA,KAAA,IAAA,qBAAa,SAAQ,SAAS,mBAC1D;CACF;CACA,IAAI,SAAS,WAAW,IAAI,MAAM;CAClC,IAAI,SAAS,aAAa,IAAI,MAAM;CACpC,IAAI,CAAC,UAAU,CAAC,QAAQ;EACtB,yBAAS,IAAI,IAAI;EACjB,yBAAS,IAAI,IAAI;EACjB,WAAW,IAAI,QAAQ,MAAM;EAC7B,aAAa,IAAI,QAAQ,MAAM;EAC/B,OAAO,eAAe,QAAQ,UAAU,eAAe;EACvD,OAAO,eAAe,QAAQ,gBAAgB,eAAe;CAC/D;CACA,MAAM,QAAQ;CACd,KAAK,MAAM,OAAO,MAAM;EACtB,IAAI,OAAO,IAAI,GAAG,GAAG;EACrB,MAAM,OAAO,OAAO,yBAAyB,QAAQ,GAAG;EACxD,IAAI,QAAQ,CAAC,KAAK,cAChB,MAAM,IAAI,UAAU,oBAAoB,IAAI,sBAAsB;EAEpE,IAAI,QAAQ,WAAW,MAAM,MAAM,IAAI,KAAK,KAAK,KAAK;EACtD,OAAO,IAAI,GAAG;EACd,OAAO,eAAe,QAAQ,KAAK;GACjC,YAAY;GACZ,cAAc;GACd,WAAW,MAAM,IAAI,GAAG;GACxB,MAAM,SAAkB,KAAK,MAAM,IAAI,KAAK,IAAI;EAClD,CAAC;CACH;AACF;;AAKA,SAAS,WAAW,QAA0B;CAC5C,OAAO;EAAC;EAAQ,WAAW,MAAM;EAAG,mBAAmB,MAAM;EAAG,UAAU,MAAM;CAAC;AACnF;;AAGA,SAAgB,WAAW,KAA6B;CACtD,MAAM,OAAO,OAAO,QAAQ,WAAW,MAAM,IAAI;CACjD,MAAM,MAAgB,CAAC;CACvB,MAAM,WAAW,IAAI,OAAO,SAAS,QAAQ,GAAG,CAAC,CAAC,KAAK,IAAI;CAC3D,IAAI,UAAU;EACZ,MAAM,OAAO,KAAK,MAAM,SAAS,EAAE,CAAE,QAAQ,SAAS,QAAQ,SAAS,EAAE,CAAC,SAAS,CAAC;EACpF,MAAM,QAAQ,KAAK,QAAQ,GAAG;EAC9B,IAAI,UAAU,IAAI,IAAI,KAAK,KAAK,MAAM,QAAQ,CAAC,CAAC;CAClD;CACA,MAAM,aAAa,KAAK,QAAQ,GAAG;CACnC,IAAI,eAAe,IAAI;EACrB,MAAM,QAAQ,KAAK,MAAM,aAAa,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM;EAC7D,KAAK,MAAM,QAAQ,MAAM,MAAM,GAAG,GAAG;GACnC,MAAM,KAAK,KAAK,QAAQ,GAAG;GAC3B,IAAI,KAAK,KAAK,YAAY,IAAI,cAAc,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GACxE,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC;EAE/B;CACF;CACA,OAAO,IAAI,QAAQ,UAAU;AAC/B;;AAGA,SAAgB,eAAe,OAAgB,QAAQ,GAAG,MAAM,IAAc;CAC5E,IAAI,OAAO,UAAU,UAAU;EAC7B,IAAI,YAAY,GAAG,GAAG,OAAO,CAAC,KAAK;EACnC,OAAO,cAAc,KAAK,KAAK,KAAK,SAAS,GAAG,IAAI,WAAW,KAAK,IAAI,CAAC;CAC3E;CACA,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,QAAQ,WAAW,OAAO,CAAC;CACtE,IAAI,OAAO,QAAQ,eAAe,iBAAiB,KAAK,OAAO,WAAW,KAAK;CAC/E,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,SAAS,MAAM,eAAe,GAAG,QAAQ,GAAG,GAAG,CAAC;CACvF,IAAI,CAAC,cAAc,KAAK,GAAG,OAAO,CAAC;CACnC,MAAM,YAAY,IAAI,YAAY,MAAM;CACxC,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,WAAW;EACtD,IAAI,aAAa,OAAO,UAAU,UAAU,OAAO,CAAC,KAAK;EACzD,IAAI,YAAY,IAAI,KAAK,UAAU,QAAQ,OAAO,UAAU,UAC1D,OAAO,eAAe,OAAO,QAAQ,GAAG,QAAQ;EAElD,OAAO,eAAe,OAAO,QAAQ,GAAG,IAAI;CAC9C,CAAC;AACH;;AAGA,SAAgB,aAAa,MAAc,SAAkD;CAC3F,IAAI,MAAM,KAAK,QAAQ,UAAU,KAAK,SAAS,EAAE;CACjD,MAAM,MAAM,IAAI,IACd,QAAQ,SAAS,MAAO,KAAK,EAAE,UAAU,oBAAoB,WAAW,CAAC,IAAI,CAAC,CAAE,CAClF;CACA,KAAK,MAAM,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAC9D,IAAI,OAAO,UAAU,mBAAmB,MAAM,IAAI,MAAM,MAAM,CAAC,CAAC,KAAK,QAAQ;CAE/E,OAAO;AACT;;AAGA,SAAgB,WAAc,KAAQ,SAA0C,QAAQ,GAAM;CAC5F,IAAI,EAAE,eAAe,UAAU,QAAQ,GAAG,OAAO;CACjD,IAAI;EACF,IAAI,UAAU,aAAa,IAAI,SAAS,OAAO;EAC/C,IAAI,IAAI,OAAO,IAAI,QAAQ,aAAa,IAAI,OAAO,OAAO;EAC1D,WAAY,IAA4B,OAAO,SAAS,QAAQ,CAAC;CACnE,QAAQ,CAER;CACA,OAAO;AACT;;AAGA,SAAgB,UAAU,SAAgE;CACxF,QAAQ,QAAQ;EACd,MAAM,WAAW,KAAK,QAAQ,CAAC;CACjC;AACF"}