node-vault-client 2.2.0 → 3.0.0

package/README.md

@@ -16,7 +16,11 @@ npm install --save node-vault-client
 
 ### Requirements
 
-Node.js >= 18 — the client uses the native `fetch` API.
+Node.js >= 20.19.0 — the client uses the native `fetch` API. Node 18 support was dropped in 3.0.0
+(Node 18 reached end-of-life on 2025-04-30 and no longer receives security patches from the
+Node.js project); see [CHANGELOG.md](CHANGELOG.md) for details.
+
+Upgrading from 2.x? [MIGRATION.md](MIGRATION.md) lists what can need a change and what to check.
 
 ### TypeScript
 
@@ -36,7 +40,8 @@ const password = lease.getValue<string>('password');
 
 `auth` is a discriminated union on `type`, so each backend only accepts its own
 configuration, and the three mutually-exclusive JWT sources (`jwt`, `jwtPath`,
-`jwtProvider`) are enforced at compile time.
+`jwtProvider`) are enforced at compile time — as is the mutually-exclusive pair
+`distributedClaimAccessToken` / `distributedClaimAccessTokenProvider`.
 
 Types that appear in signatures are exported in type space under the `VaultClient`
 namespace — `VaultClient.Lease`, `VaultClient.VaultOptions`, `VaultClient.AuthToken`
@@ -167,8 +172,9 @@ const vaultClient = VaultClient.boot('main', {
         type: 'jwt',
         mount: 'jwt',                                  // Optional. Vault JWT auth mount point ("jwt" by default)
         config: {
-            role: 'my-app',                             // Optional. Role configured in Vault's JWT auth backend; omitted uses the mount's `default_role`
-            jwt: process.env.CI_JOB_JWT,                // Exactly one of `jwt` / `jwtPath` / `jwtProvider` is required (see below)
+            role: 'my-app',                                       // Optional. Role configured in Vault's JWT auth backend; omitted uses the mount's `default_role`
+            jwt: process.env.CI_JOB_JWT,                          // Exactly one of `jwt` / `jwtPath` / `jwtProvider` is required (see below)
+            distributedClaimAccessToken: process.env.GRAPH_TOKEN, // Optional. Azure/Entra ID group lookups only (see below); or `distributedClaimAccessTokenProvider`
         },
     },
 });
@@ -191,6 +197,96 @@ Exactly one of three mutually exclusive `config` keys supplies the JWT:
   be minted per login — GitHub Actions' `core.getIDToken()`, a cloud metadata endpoint, a
   SPIFFE/SPIRE workload API.
 
+##### The Vault role needs `bound_audiences` when your JWT carries an `aud` claim
+
+This is server-side configuration rather than a client option, but it is the most common reason a
+first login fails. Vault requires a `jwt` role to bind the audience your token carries, and it does
+**not** catch the omission when the role is created — as long as the role has some other bound
+constraint (`bound_subject`, `bound_claims`, ...) it is accepted, and the problem only surfaces at
+login:
+
+```
+VaultHttpError: 400 - {"errors":["audience claim found in JWT but no audiences bound to the role"]}
+```
+
+A wrong (rather than missing) audience fails with `error validating token: invalid audience (aud)
+claim: audience claim does not match any expected audience`. So bind the audience the token
+actually has:
+
+```shell
+vault write auth/jwt/role/my-app \
+    role_type=jwt user_claim=sub bound_audiences=my-audience token_policies=my-policy
+```
+
+A role with *no* bound constraint at all is rejected when you create it (`must have at least one
+bound constraint when creating/updating a role`), so that case is self-correcting. An `aud` array
+is fine — Vault matches `bound_audiences` against any entry.
+
+Vault also does not require an `exp` claim: a token minted without one is accepted and never
+expires. If you write your own `jwtProvider`, give the tokens it mints a short `exp`.
+
+##### Azure / Entra ID group lookups need `distributedClaimAccessToken`
+
+Skip this unless you log in with Microsoft Entra ID (Azure AD) tokens *and* the Vault role sets
+`groups_claim`. Vault's `distributed_claim_access_token` parameter
+["only applies to the Azure (Entra ID) provider"](https://developer.hashicorp.com/vault/api-docs/auth/jwt#distributed_claim_access_token);
+on every other IdP these two keys do nothing at all.
+
+Azure does not always put group membership in the token. Past 200 groups it sends OIDC
+[distributed claims](https://openid.net/specs/openid-connect-core-1_0.html#AggregatedDistributedClaims)
+instead — `_claim_names`/`_claim_sources` pointing at the Microsoft Graph API rather than the group
+names themselves — and a mount configured with `fetch_groups` skips the claim entirely and always
+asks Graph. Either way Vault has to call Graph itself, and the JWT you logged in with is not a
+credential for that call: it needs a separate Graph access token, sent on the login request as the
+optional `distributed_claim_access_token`. Leave it out on a mount/role set up this way and the
+login fails at the group-fetch step — *after* the JWT has already validated, so the error names the
+group lookup rather than anything about your token.
+
+Two optional, mutually exclusive `config` keys supply it. Passing both raises
+`InvalidArgumentsError` at construction; passing neither leaves the login request byte-for-byte
+what it was before these keys existed.
+
+* **`distributedClaimAccessToken`** — a literal Graph access token. It carries exactly the caveat
+  the literal `jwt` above does, for the same reason: the value is fixed at construction and every
+  re-login re-sends it, so it works until that token expires. Entra access tokens last about an
+  hour, which is shorter than most processes — fine for a one-shot script, wrong for a service.
+* **`distributedClaimAccessTokenProvider`** — an (optionally async) function, called fresh at login
+  time (never at construction, never cached), returning `string | Promise<string>`. Acquire the
+  Graph token inside it — an MSAL client-credentials call, the Azure IMDS managed-identity endpoint
+  — and every login gets a current one. Resolving to a non-string or an empty string raises
+  `InvalidArgumentsError` without sending a login request.
+
+```javascript
+const vaultClient = VaultClient.boot('main', {
+    api: { url: 'https://vault.example.com:8200/' },
+    auth: {
+        type: 'jwt',
+        config: {
+            role: 'my-app',
+            jwtProvider: () => getEntraIdToken(),
+            distributedClaimAccessTokenProvider: () => getGraphAccessToken(),
+        },
+    },
+});
+```
+
+On the Vault side, `fetch_groups` lives in `provider_config` on the **mount's config, not on the
+role** — which is where people tend to look for it:
+
+```shell
+vault write auth/jwt/config \
+    oidc_discovery_url=https://login.microsoftonline.com/<tenant-id>/v2.0 \
+    provider_config='{"provider":"azure","fetch_groups":true}'
+
+vault write auth/jwt/role/my-app \
+    role_type=jwt user_claim=sub bound_audiences=<application-client-id> \
+    groups_claim=groups token_policies=my-policy
+```
+
+`fetch_groups` is optional — the distributed-claim path is taken without it whenever Azure omits
+the groups claim. `groups_claim` on the role is not: with it unset Vault never resolves groups at
+all, so a Graph token you pass is accepted and never used.
+
 #### Authenticating from GitHub Actions
 
 ```yaml
@@ -212,6 +308,18 @@ const vaultClient = VaultClient.boot('ci', {
 });
 ```
 
+`core.getIDToken('vault')` mints a token whose `aud` is `vault`, so the role has to bind that
+audience or the login fails with `audience claim found in JWT but no audiences bound to the role`:
+
+```shell
+vault write auth/gha/role/ci \
+    role_type=jwt user_claim=sub bound_audiences=vault \
+    bound_claims='{"repository":"my-org/my-repo"}' token_policies=ci
+```
+
+Pass the same string to `core.getIDToken()` and to `bound_audiences`. Calling `getIDToken()` with
+no argument uses GitHub's default audience instead, which then will not match.
+
 `role` is optional here too — omit it to use the mount's `default_role`. `mount` and
 `api.namespace` behave exactly as they do for the other four backends.
 
@@ -367,7 +475,7 @@ Client constructor function.
 | [options.auth.renewal] | <code>boolean</code> | <code>true</code> | Set `false` to never renew the Vault token in the background; the token is used until it expires and the next call re-authenticates. See [Token renewal](#token-renewal). |
 | [options.auth.renewalFraction] | <code>number</code> | <code>0.5</code> | How much of the token's remaining lifetime to wait before renewing, as a fraction in `(0, 1)`. |
 | [options.auth.renewalIncrement] | <code>number</code> |  | Seconds of extra TTL to request on each renewal, sent as `increment` to `auth/token/renew-self`. Vault caps it at the token's max TTL. |
-| [options.logger] | <code>Object</code> \| <code>false</code> |  | Logger that must implement **all five** of "error", "warn", "info", "debug" and "trace" — an object missing any one of them is silently ignored and the default logger is used instead. The default logger writes to `console`, except `debug`, which is discarded so that sensitive data is never printed. Pass `false` to disable logging entirely. |
+| [options.logger] | <code>Object</code> \| <code>false</code> |  | Logger that must implement **all five** of "error", "warn", "info", "debug" and "trace" — an object missing any one of them is silently ignored and the default logger is used instead. The default logger writes to `console`, except `debug`, which is discarded. Failure logs (`error` level) never include a Vault response body: only the HTTP status and Vault's `errors` strings, which can quote back malformed request fields. Pass `false` to disable logging entirely. |
 
 ##### Custom transport (proxy / self-signed TLS)
 
@@ -524,7 +632,8 @@ Raw request — escape hatch for any Vault backend
 
 Sends the literal API path with no KV path rewriting and no response unwrapping, and
 resolves to the parsed response body. Use it for non-KV backends (e.g. Transit) or when you
-have already constructed the complete Vault API path.
+have already constructed the complete Vault API path. The path is **not validated** (see
+[Path validation](#path-validation)), so never build it from untrusted input.
 
 **Kind**: instance method of [<code>VaultClient</code>](#VaultClient)  
 
@@ -796,6 +905,11 @@ const result = await client.request('POST', 'transit/encrypt/my-key', {
 console.log(result.data.ciphertext);
 ```
 
+Transit batch encrypt/decrypt answers HTTP 400 when any item fails, and the rejection's
+`err.error.data.batch_results` still holds the successful items. Pass
+`partial_failure_response_code: 200` (Vault 1.12+) and check each item's `error` if you don't want
+that data on an error path.
+
 ### Lease.getMetadata()
 
 `getMetadata()` is additive — existing code is unaffected.
@@ -831,10 +945,51 @@ rewriting:
 await client.request('GET', 'secret/data/foo');
 ```
 
+### Path validation
+
+The KV methods (`read`, `list`, `write`, `delete`, `update` and the KV v2 helpers) reject a
+path with `InvalidArgumentsError`, before any request is sent, when the URL parser or Vault
+would resolve it to a different path than the one passed:
+
+- an empty path;
+- `?`, `#`, `\`, a control character (U+0000–U+001F, U+007F), an unpaired surrogate or a
+  trailing space;
+- a percent-encoded `.`, `/`, `\` or `%` (`%2e`, `%2f`, `%5c`, `%25`, in any case). Vault decodes
+  these and cleans the path again on every redirect hop, so they are rejected rather than decoded;
+- an empty segment such as `a//b` or `a//`, which Vault collapses into the parent path, so
+  `tenants/${id}/key` with an empty `id` would address `tenants/key`;
+- a `.` or `..` segment;
+- a percent-encoded mount (`secre%74/foo`): the `engines` override and mount detection match the
+  path as written, but Vault decodes it, so `secre%74/config` would skip the KV v2 rewrite and
+  reach the mount's own `config` endpoint;
+- a trailing slash on the KV v2 helpers (`deleteVersions`, `undeleteVersions`,
+  `destroyVersions`, `readMetadata`, `deleteMetadata`): Vault applies a metadata call on
+  `tenants/me/` to the key `tenants/me`.
+
+Leading slashes are dropped before the mount is resolved, so `/secret/foo` and `secret/foo`
+address the same key (an `engines` key may be written either way). The other methods keep a
+single trailing slash, as in `list('secret/apps/')`. A percent-encoded segment of a
+multi-segment mount (`team/k%76/foo` for the mount `team/kv`) is rejected too: by the `engines`
+lookup, or after detection with `autoDetect`.
+
+A key name that needs `?` or `#` can still be addressed percent-encoded (`%3F`, `%23`); Vault
+decodes it. A key that needs any other rejected character goes through `request()`, as does a
+specific KV v2 version, which used to work as `read('secret/foo?version=2')`:
+`request('GET', 'secret/data/foo?version=2')`. These checks apply in every mode (passthrough,
+`engines`, `autoDetect`). `request()` sends its path literally and does not apply them.
+
+Still validate lower-trust input before building a path from it: these checks only stop a path
+from reaching a different Vault path than the one it names, not a caller from naming another
+tenant's secret.
+
+A validation error's message says which rule failed but does not include the path, because the
+KV methods log the message at `error` level.
+
 ### Mount detection caching
 
 - Each canonical mount is detected once and then cached for the life of the `VaultClient` instance. The cache is a bounded LRU with a fixed cap of 500 mounts (not configurable through client options); a long-lived client that touches more than 500 distinct mounts evicts the least-recently-used entries, and an evicted mount is detected again on its next use.
 - Concurrent first-touch requests for the same mount share a single in-flight detection promise.
+- A detection response without a string `path` and `type` fails the call with `VaultError` and nothing is cached. A well-formed answer is cached only when its mount contains the requested path; when it does not, that caller gets `InvalidArgumentsError` and callers sharing the detection are unaffected. Auth mounts are cached as `auth/<mount>`, so they never collide with a secrets mount of the same name, and a mount in a child namespace is keyed relative to `api.namespace`.
 - The detection endpoint used is `GET sys/internal/ui/mounts/<path>` (readable by any authenticated token).
 - When the token lacks permission on that endpoint, set `api.engines` to skip detection.
 
@@ -860,8 +1015,8 @@ try {
 | Class | Extends | When thrown |
 |---|---|---|
 | `VaultError` | `Error` | Base class for every error below. Raised directly when mount detection fails (e.g. permission denied) and no `api.engines` override was provided. |
-| `VaultHttpError` | `VaultError` | Vault answered with a non-2xx status. Carries the status as `statusCode` and the parsed body as `error`. |
-| `InvalidArgumentsError` | `VaultError` | Bad arguments or configuration: `boot()` called without options, an unknown instance name passed to `get()`, an unsupported `auth.type`, invalid renewal options, or an invalid node-config substitution map. |
+| `VaultHttpError` | `VaultError` | Vault answered with a non-2xx status. Carries the status as `statusCode` and the parsed body as `error`. `message` (`"<status> - <raw body text>"`) and `error` hold the full response body, which can include secret material (e.g. a partially failed transit batch), so log `statusCode` and `error.errors` rather than the error object itself. |
+| `InvalidArgumentsError` | `VaultError` | Bad arguments or configuration: `boot()` called without options, an unknown instance name passed to `get()`, an unsupported `auth.type`, invalid renewal options, an invalid node-config substitution map, or a KV method path that fails [path validation](#path-validation). |
 | `InvalidAWSCredentialsError` | `InvalidArgumentsError` | `auth.config.credentials` was supplied but is not a usable `accessKeyId` / `secretAccessKey` pair. |
 | `AuthTokenExpiredError` | `VaultError` | The Vault token expired and the backend cannot obtain a new one. `token` auth can never re-authenticate; other backends reach this only with `renewal: false` and a credential they cannot replay. |
 | `UnsupportedOperationError` | `VaultError` | A v2-only method (`deleteVersions`, `undeleteVersions`, `destroyVersions`, `readMetadata`, `deleteMetadata`) was called against a mount that did not resolve as KV v2. |

package/index.d.ts

@@ -79,12 +79,18 @@ declare namespace VaultClient {
         namespace?: string;
     }
 
+    type JwtDistributedClaimConfig =
+        | { distributedClaimAccessToken?: never; distributedClaimAccessTokenProvider?: never }
+        | { distributedClaimAccessToken: string; distributedClaimAccessTokenProvider?: never }
+        | { distributedClaimAccessTokenProvider: () => string | Promise<string>; distributedClaimAccessToken?: never };
+
     type JwtAuthConfig = JwtAuthConfigCommon &
         (
             | { jwt: string; jwtPath?: never; jwtProvider?: never }
             | { jwtPath: string; jwt?: never; jwtProvider?: never }
             | { jwtProvider: () => string | Promise<string>; jwt?: never; jwtPath?: never }
-        );
+        ) &
+        JwtDistributedClaimConfig;
 
     interface AuthOptionsCommon {
         mount?: string;

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "node-vault-client",
-  "version": "2.2.0",
+  "version": "3.0.0",
   "description": "A Vault Client implemented in pure javascript for HashiCorp Vault. It supports variety of Auth Backends and performs lease renewal for issued auth token.",
   "repository": {
     "url": "git+https://github.com/namecheap/node-vault-client.git"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.19.0"
   },
   "main": "src/VaultClient.js",
   "types": "index.d.ts",
@@ -45,31 +45,31 @@
   "author": "Namecheap <opensource@namecheap.com>",
   "license": "Apache-2.0",
   "dependencies": {
-    "@aws-sdk/credential-providers": "^3.1100.0",
+    "@aws-sdk/credential-providers": "^3.1130.0",
     "aws4": "^1.13.2",
     "long-timeout": "^0.1.1"
   },
   "peerDependencies": {
-    "config": ">=1 <4"
+    "config": ">=1 <5"
   },
   "overrides": {
-    "serialize-javascript": "^7.0.7",
+    "serialize-javascript": "^7.1.4",
     "glob": "^13.0.0",
     "diff": "^8.0.3",
-    "brace-expansion": "^5.0.9",
-    "js-yaml": "^4.3.0"
+    "brace-expansion": "^5.0.12",
+    "js-yaml": "^4.3.2"
   },
   "devDependencies": {
-    "@eslint/js": "^9.39.5",
-    "c8": "^10.1.3",
+    "@eslint/js": "^10.0.1",
+    "c8": "^12.0.0",
     "chai": "^6.2.2",
     "deep-freeze": "^0.0.1",
-    "eslint": "^9.39.5",
+    "eslint": "^10.10.0",
     "globals": "^17.8.0",
     "lodash": "^4.18.1",
-    "mocha": "^11.7.6",
+    "mocha": "^12.0.0",
     "sinon": "^22.1.0",
     "sinon-chai": "^4.0.1",
-    "typescript": "^5.9.3"
+    "typescript": "^7.0.2"
   }
 }

package/src/MountResolver.js

@@ -1,6 +1,8 @@
 'use strict';
 
 const { VaultError, InvalidArgumentsError } = require('./errors');
+const safeMessage = require('./safeMessage');
+const { trimTrailingSlashes, trimSlashes } = require('./slashes');
 
 // Default cap for the mount cache. Real deployments talk to a handful of static
 // mounts, so this is generous headroom; the cap exists so that a long-lived
@@ -8,6 +10,32 @@ const { VaultError, InvalidArgumentsError } = require('./errors');
 // cache — and the per-resolve lookup cost — without bound (issue #108).
 const DEFAULT_MAX_CACHE_SIZE = 500;
 
+/** True when `mount` is `path` itself or a whole-segment prefix of it. */
+function containsPath(mount, path) {
+    return mount !== '' && (path === mount || path.startsWith(mount + '/'));
+}
+
+/**
+ * Per GHSA-rr65/GHSA-wf8v a mount must be named literally: Vault decodes the path, so
+ * 'team/k%76/x' would reach the 'team/kv' mount while matching it neither in the engines map
+ * nor as a prefix, and the KV v2 rewrite would be skipped or built on the wrong mount.
+ */
+function encodedMountError(mount) {
+    return new InvalidArgumentsError(
+        `Invalid secret path: it does not start with the mount "${mount}" it resolved to; ` +
+        'do not percent-encode the mount'
+    );
+}
+
+// '%2f' and '%25' never get here (VaultClient rejects them), so one decode is what Vault sees.
+function decodePath(path) {
+    try {
+        return decodeURIComponent(path);
+    } catch {
+        return path;
+    }
+}
+
 /**
  * Resolves the KV engine version for a given secret path.
  *
@@ -23,10 +51,15 @@ const DEFAULT_MAX_CACHE_SIZE = 500;
  * @param {Object}   [opts]              - additional options
  * @param {boolean}  [opts.disabled]     - if true, always return passthrough (version 1)
  * @param {number}   [opts.maxCacheSize] - LRU cap for the mount cache (default 500)
+ * @param {string}   [opts.namespace]    - the client's Vault namespace (X-Vault-Namespace)
  */
 class MountResolver {
     constructor(detectFn, enginesOverride, logger, opts) {
         this.__detectFn = detectFn;
+        // Vault reports a mount in a child namespace with its full namespace path
+        // ("ns1/ns2/secret/"), while the caller's path is relative to this namespace.
+        const namespace = opts && typeof opts.namespace === 'string' ? trimSlashes(opts.namespace) : '';
+        this.__namespacePrefix = namespace ? `${namespace}/` : '';
         this.__log = logger;
         this.__disabled = opts && opts.disabled === true;
         // Validate before use: a non-positive cap would make the eviction loop in
@@ -43,10 +76,11 @@ class MountResolver {
 
         // The engines map is immutable after construction: normalize and sort the
         // entries once (longest raw prefix first, matching the previous per-call
-        // sort) instead of re-sorting on every resolve().
+        // sort) instead of re-sorting on every resolve(). Leading slashes go too:
+        // VaultClient drops them from the path before it gets here.
         this.__engines = Object.entries(enginesOverride || {})
             .sort((a, b) => b[0].length - a[0].length)
-            .map(([prefix, version]) => [prefix.replace(/\/+$/, ''), Number(version)]);
+            .map(([prefix, version]) => [trimSlashes(prefix), Number(version)]);
 
         // LRU cache: canonical mount path (no trailing slash) -> { mount, version, type }.
         // Map iteration order is insertion order; hits are re-inserted to refresh
@@ -66,6 +100,10 @@ class MountResolver {
         // 1. Check engines override (longest-prefix match). This applies even when
         //    auto-detection is disabled, so listed mounts resolve with no I/O.
         const override = this.__enginesOverrideLookup(path);
+        const decodedOverride = this.__enginesOverrideLookup(decodePath(path));
+        if (decodedOverride !== null && (override === null || override.mount !== decodedOverride.mount)) {
+            return Promise.reject(encodedMountError(decodedOverride.mount));
+        }
         if (override !== null) {
             this.__log.debug('MountResolver: engines override for %s -> v%d', path, override.version);
             return Promise.resolve(override);
@@ -86,8 +124,15 @@ class MountResolver {
         //    if it does not (two distinct multi-segment mounts share a first segment,
         //    e.g. team/kvA/* and team/kvB/*), we start a fresh detection using the
         //    full path as key so each mount gets its own call.
+        //    Each caller checks the result against its own path, so one caller's bad path
+        //    cannot fail others sharing the detection.
         const interimKey = path.split('/')[0];
-        return this.__detectWithCache(interimKey, path);
+        return this.__detectWithCache(interimKey, path).then((entry) => {
+            if (!containsPath(entry.mount, path)) {
+                throw encodedMountError(entry.mount);
+            }
+            return entry;
+        });
     }
 
     // -------------------------------------------------------------------------
@@ -101,7 +146,7 @@ class MountResolver {
      */
     __enginesOverrideLookup(path) {
         for (const [prefix, version] of this.__engines) {
-            if (path === prefix || path.startsWith(prefix + '/')) {
+            if (containsPath(prefix, path)) {
                 return { mount: prefix, version, type: 'kv' };
             }
         }
@@ -164,7 +209,7 @@ class MountResolver {
             // Join the existing in-flight promise but verify the result matches our path.
             // If the detection was for a different sub-mount, start a fresh detection.
             return this.__inflight.get(interimKey).then((entry) => {
-                if (path === entry.mount || path.startsWith(entry.mount + '/')) {
+                if (containsPath(entry.mount, path)) {
                     return entry;
                 }
                 // The shared detection resolved to a different mount — start our own.
@@ -181,8 +226,16 @@ class MountResolver {
                     throw new Error('Unexpected empty detection response');
                 }
 
-                const canonicalMount = (info.path || interimKey).replace(/\/+$/, '');
-                const type = info.type || 'unknown';
+                // Require a mounts-endpoint shape (string path and type) and never fall back
+                // to a caller-derived key or a default type. This does not authenticate the
+                // response: a planted secret could carry the same fields. What keeps the
+                // detection request on the mounts endpoint is the path validation in
+                // VaultClient; this only stops a malformed answer from becoming routing.
+                if (typeof info.path !== 'string' || typeof info.type !== 'string' || !trimTrailingSlashes(info.path)) {
+                    throw new Error('Unexpected detection response shape (missing string path/type)');
+                }
+                const canonicalMount = this.__canonicalMount(info.path, path);
+                const type = info.type;
                 const optVersion = info.options && info.options.version;
                 // Only kv v2 gets special treatment; everything else is passthrough
                 const version = (type === 'kv' && optVersion === '2') ? 2 : 1;
@@ -190,8 +243,11 @@ class MountResolver {
                 const entry = { mount: canonicalMount, version, type };
                 this.__log.debug('MountResolver: detected %s as type=%s version=%d', canonicalMount, type, version);
 
-                // Store in persistent cache (bounded LRU)
-                this.__cacheStore(canonicalMount, entry);
+                // Cache only an answer that contains the path it was asked for; resolve()
+                // rejects a caller whose path the mount does not contain.
+                if (containsPath(canonicalMount, path)) {
+                    this.__cacheStore(canonicalMount, entry);
+                }
                 // Clear in-flight
                 this.__inflight.delete(interimKey);
                 return entry;
@@ -199,9 +255,12 @@ class MountResolver {
             .catch((err) => {
                 // Clear in-flight so callers can retry
                 this.__inflight.delete(interimKey);
+                // safeMessage: this message is logged by the operation's catch handler, so it
+                // must not embed a raw response body; the original error stays on `cause`.
                 throw new VaultError(
-                    `Failed to detect KV engine version for mount "${interimKey}" (path: ${path}): ${err.message}. ` +
-                    'Set api.engines or disable autoDetect to bypass detection.'
+                    `Failed to detect KV engine version for mount "${interimKey}" (path: ${path}): ${safeMessage(err)}. ` +
+                    'Set api.engines or disable autoDetect to bypass detection.',
+                    { cause: err }
                 );
             });
 
@@ -209,6 +268,26 @@ class MountResolver {
         return promise;
     }
 
+    /**
+     * The cache key for a detected mount. For auth mounts Vault reports the path without the
+     * reserved "auth/" prefix (auth/apps/role/r -> "apps/"), so it is re-added and the entry
+     * cannot collide with a secrets mount of the same name. A mount in a child namespace is
+     * reported with the client's namespace in front; that prefix is dropped when only the
+     * shorter form contains the path.
+     */
+    __canonicalMount(reportedPath, path) {
+        const withTable = (mount) => (path.startsWith('auth/') ? `auth/${mount}` : mount);
+        const reported = trimTrailingSlashes(reportedPath);
+        const mount = withTable(reported);
+        if (!containsPath(mount, path) && this.__namespacePrefix && reported.startsWith(this.__namespacePrefix)) {
+            const relative = withTable(reported.slice(this.__namespacePrefix.length));
+            if (containsPath(relative, path)) {
+                return relative;
+            }
+        }
+        return mount;
+    }
+
     /**
      * Simple first-segment extraction used only for the disabled path.
      */

package/src/VaultApiClient.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const errors = require('./errors');
+const { trimTrailingSlashes } = require('./slashes');
 
 /**
  * Joins URL segments with single slashes while preserving the leading
@@ -14,7 +15,7 @@ function joinUrl(...parts) {
                 segment = segment.replace(/^\/+/, '');
             }
             if (i < parts.length - 1) {
-                segment = segment.replace(/\/+$/, '');
+                segment = trimTrailingSlashes(segment);
             }
             return segment;
         })

package/src/VaultClient.js

@@ -12,6 +12,8 @@ const VaultKubernetesAuth = require('./auth/VaultKubernetesAuth');
 const VaultJwtAuth = require('./auth/VaultJwtAuth');
 const MountResolver = require('./MountResolver');
 const { rewritePath, normalizeResponse } = require('./kvTransform');
+const safeMessage = require('./safeMessage');
+const { trimTrailingSlashes } = require('./slashes');
 
 const noop = () => {};
 const vaultInstances = {};
@@ -46,6 +48,74 @@ function optionsDigest(options) {
     return crypto.createHash('sha256').update(fingerprintOptions(options)).digest('hex');
 }
 
+// fetch() parses the joined URL per the WHATWG URL Standard: '?' starts the query, '#' the
+// fragment, '\' is a path separator for http(s), tab/LF/CR are deleted anywhere and trailing
+// C0 controls and spaces are stripped. Any of these lets a KV path address a different key.
+// eslint-disable-next-line no-control-regex
+const UNSAFE_KV_PATH_CHARS = /[?#\\\u0000-\u001f\u007f]/;
+
+/**
+ * Rejects a KV method path that the URL parser or Vault would resolve to a path other than
+ * `<mount>/<kv segment>/<logical path>` (GHSA-rr65-m54w-rfr9, GHSA-wf8v-q2h3-hgjm).
+ *
+ * fetch() removes '.' and '..' segments, and Vault redirects a raw '//' to the collapsed path,
+ * which fetch() follows (a 301 on Vault 1.x turns a write into a read, a 307 on 2.x writes the
+ * parent key). Encoded forms are rejected rather than decoded: Vault decodes %2e and %2f before
+ * its KV v2 engine resolves '..' and collapses empty segments, and Vault 2.x decodes and
+ * path-cleans again on every redirect hop, so a %25-encoded escape becomes %2e or %2f on the
+ * first hop and a real dot segment or separator on the second. No other escape can form a dot
+ * segment or a separator, so the segments are then checked as written.
+ *
+ * One trailing slash is allowed (list() addresses a folder with it, and the other methods
+ * pass it through byte for byte), except on the KV v2 helpers: those always address a single
+ * key, and Vault applies a metadata call on 'tenants/me/' to the key 'tenants/me', so
+ * deleteMetadata() would delete it. Unpaired surrogates are rejected because fetch() encodes
+ * every one of them as U+FFFD.
+ *
+ * The messages never include the path: the KV methods log them at error level, and the path
+ * may be built from user data that was never logged before.
+ *
+ * The mount (first segment) must not be percent-encoded: the engines override and mount
+ * detection match the path as written, but Vault decodes it, so 'secre%74/config' would skip
+ * the KV v2 rewrite and reach the mount's own config endpoint.
+ *
+ * @param {*} path - caller-supplied secret path
+ * @param {boolean} allowTrailingSlash - false for the KV v2 helpers
+ * @returns {string} the path without leading slashes, which VaultApiClient drops from the URL
+ *      anyway; resolving the mount on it keeps the KV v2 rewrite from taking '/secret/foo'
+ *      for a key in 'secret/'
+ * @throws {InvalidArgumentsError}
+ * @private
+ */
+function assertSafeKvPath(path, allowTrailingSlash) {
+    if (typeof path !== 'string' || path === '') {
+        throw new errors.InvalidArgumentsError('Invalid secret path: expected a non-empty string');
+    }
+    if (UNSAFE_KV_PATH_CHARS.test(path) || path.endsWith(' ') || !path.isWellFormed()) {
+        throw new errors.InvalidArgumentsError(
+            'Invalid secret path: \'?\', \'#\', \'\\\', control characters, unpaired surrogates and a ' +
+            'trailing space are not allowed'
+        );
+    }
+    if (/%(2e|2f|5c|25)/i.test(path)) {
+        throw new errors.InvalidArgumentsError(
+            'Invalid secret path: encoded dots, separators or percent signs are not allowed'
+        );
+    }
+    const trimmed = path.replace(/^\/+/, '');
+    if (trimmed.split('/')[0].includes('%')) {
+        throw new errors.InvalidArgumentsError('Invalid secret path: the mount must not be percent-encoded');
+    }
+    const segments = (allowTrailingSlash ? trimmed.replace(/\/$/, '') : trimmed).split('/');
+    if (segments.some((segment) => segment === '' || segment === '.' || segment === '..')) {
+        throw new errors.InvalidArgumentsError(
+            'Invalid secret path: empty, \'.\' and \'..\' segments are not allowed ' +
+            '(nor a trailing slash in the KV v2 helpers)'
+        );
+    }
+    return trimmed;
+}
+
 class VaultClient {
 
     /**
@@ -127,6 +197,7 @@ class VaultClient {
 
         this.__resolver = new MountResolver(detectFn, engines, this.__log, {
             disabled: resolverDisabled,
+            namespace,
         });
     }
 
@@ -341,11 +412,22 @@ class VaultClient {
      *      engine version (merge-patch update() semantics); by default only v2
      *      write/update wrap non-null data and everything else passes through
      * @returns {Promise<{body: *, version: (number|undefined), mount: (string|undefined), apiPath: string}>}
+     *      rejects with InvalidArgumentsError, before any request, for an unsafe KV path
      * @private
      */
     __resolveAndRequest(op, method, path, data, extraHeaders, options) {
         const { raw = false, v2Only = false, wrapData = false } = options || {};
 
+        // KV paths are validated before the token fetch, mount resolution and the autoDetect
+        // detection request; request() (raw) keeps its documented literal-path semantics.
+        if (!raw) {
+            try {
+                path = assertSafeKvPath(path, !v2Only);
+            } catch (err) {
+                return Promise.reject(err);
+            }
+        }
+
         return this.__auth.getAuthToken()
             .then((token) => {
                 const headers = Object.assign({}, this.getHeaders(token), extraHeaders || {});
@@ -398,10 +480,17 @@ class VaultClient {
      * @private
      */
     __logicalPath(path, mount) {
-        const prefix = mount.replace(/\/+$/, '');
+        const prefix = trimTrailingSlashes(mount);
         if (path === prefix) return '';
         if (path.startsWith(prefix + '/')) return path.slice(prefix.length + 1);
-        return path;
+        // Detection decodes the path, so with a multi-segment mount 'team/k%76/foo' resolves to
+        // 'team/kv'; rewriting it as a key inside that mount would address 'team/kv/team/kv/foo'
+        // (GHSA-rr65-m54w-rfr9). MountResolver.resolve() already rejects that; this guards the
+        // rewrite itself.
+        throw new errors.InvalidArgumentsError(
+            `Invalid secret path: it does not start with the mount "${prefix}" it resolved to; ` +
+            'do not percent-encode the mount'
+        );
     }
 
     // -------------------------------------------------------------------------
@@ -422,7 +511,7 @@ class VaultClient {
                 return Lease.fromResponse(normalised);
             })
             .catch((reason) => {
-                this.__log.error('read secret failed: %s', reason.message);
+                this.__log.error('read secret failed: %s', safeMessage(reason));
                 throw reason;
             });
     }
@@ -442,7 +531,7 @@ class VaultClient {
                 return Lease.fromResponse(normalised);
             })
             .catch((reason) => {
-                this.__log.error('list secrets failed: %s', reason.message);
+                this.__log.error('list secrets failed: %s', safeMessage(reason));
                 throw reason;
             });
     }
@@ -462,7 +551,7 @@ class VaultClient {
                 return body;
             })
             .catch((reason) => {
-                this.__log.error('write secret failed: %s', reason.message);
+                this.__log.error('write secret failed: %s', safeMessage(reason));
                 throw reason;
             });
     }
@@ -484,7 +573,7 @@ class VaultClient {
                 return body;
             })
             .catch((reason) => {
-                this.__log.error('delete secret failed: %s', reason.message);
+                this.__log.error('delete secret failed: %s', safeMessage(reason));
                 throw reason;
             });
     }
@@ -509,14 +598,15 @@ class VaultClient {
             { 'Content-Type': 'application/merge-patch+json' }, { wrapData: true })
             .then(({ body }) => body)
             .catch((reason) => {
-                this.__log.error('update secret failed: %s', reason.message);
+                this.__log.error('update secret failed: %s', safeMessage(reason));
                 throw reason;
             });
     }
 
     /**
      * Raw request — literal path, no path rewriting or response unwrapping.
-     * Returns the parsed body directly.
+     * Returns the parsed body directly. The path is not validated: never build it from
+     * untrusted input.
      *
      * @param {string} method - HTTP method
      * @param {string} path   - literal API path
@@ -528,7 +618,7 @@ class VaultClient {
         return this.__resolveAndRequest('request', method, path, data === undefined ? null : data, null, { raw: true })
             .then(({ body }) => body)
             .catch((reason) => {
-                this.__log.error('raw request failed: %s', reason.message);
+                this.__log.error('raw request failed: %s', safeMessage(reason));
                 throw reason;
             });
     }
@@ -549,7 +639,7 @@ class VaultClient {
         this.__log.debug('deleteVersions %s %j', path, versions);
         return this.__v2Only('deleteVersions', 'POST', path, { versions })
             .catch((reason) => {
-                this.__log.error('deleteVersions failed: %s', reason.message);
+                this.__log.error('deleteVersions failed: %s', safeMessage(reason));
                 throw reason;
             });
     }
@@ -566,7 +656,7 @@ class VaultClient {
         this.__log.debug('undeleteVersions %s %j', path, versions);
         return this.__v2Only('undeleteVersions', 'POST', path, { versions })
             .catch((reason) => {
-                this.__log.error('undeleteVersions failed: %s', reason.message);
+                this.__log.error('undeleteVersions failed: %s', safeMessage(reason));
                 throw reason;
             });
     }
@@ -583,7 +673,7 @@ class VaultClient {
         this.__log.debug('destroyVersions %s %j', path, versions);
         return this.__v2Only('destroyVersions', 'POST', path, { versions })
             .catch((reason) => {
-                this.__log.error('destroyVersions failed: %s', reason.message);
+                this.__log.error('destroyVersions failed: %s', safeMessage(reason));
                 throw reason;
             });
     }
@@ -602,7 +692,7 @@ class VaultClient {
                 return normalizeResponse(2, 'readMetadata', body);
             })
             .catch((reason) => {
-                this.__log.error('readMetadata failed: %s', reason.message);
+                this.__log.error('readMetadata failed: %s', safeMessage(reason));
                 throw reason;
             });
     }
@@ -618,7 +708,7 @@ class VaultClient {
         this.__log.debug('deleteMetadata %s', path);
         return this.__v2Only('deleteMetadata', 'DELETE', path, null)
             .catch((reason) => {
-                this.__log.error('deleteMetadata failed: %s', reason.message);
+                this.__log.error('deleteMetadata failed: %s', safeMessage(reason));
                 throw reason;
             });
     }

package/src/VaultNodeConfig.js

@@ -8,6 +8,26 @@ function isObject(value) {
     return value !== null && typeof value === 'object';
 }
 
+/**
+ * Resolves NODE_CONFIG_DIR the same way `config`'s own `util.initParam` historically did —
+ * a `--NODE_CONFIG_DIR=value` command-line argument, then the environment variable, then
+ * `defaultValue` — implemented directly rather than through `config.util.initParam`, which
+ * config 4.x removed from its public API without documenting the removal (`config.util` is
+ * now a `ConfigUtils` instance with no `initParam` method at all; calling it throws
+ * "config.util.initParam is not a function"). This also means resolution no longer depends
+ * on which `config` major is installed.
+ *
+ * @private
+ */
+function resolveConfigDir(defaultValue) {
+    const argPrefix = '--NODE_CONFIG_DIR=';
+    const cmdLineArg = process.argv.slice(2).find((arg) => arg.startsWith(argPrefix));
+    if (cmdLineArg !== undefined) {
+        return cmdLineArg.slice(argPrefix.length);
+    }
+    return process.env.NODE_CONFIG_DIR || defaultValue;
+}
+
 function isPlainObject(value) {
     if (!isObject(value)) {
         return false;
@@ -112,7 +132,7 @@ class VaultNodeConfig {
      * @private
      */
     __getSubstitutionMap() {
-        let configDir = this.__nodeConfig.util.initParam('NODE_CONFIG_DIR', path.join(process.cwd(), 'config'));
+        let configDir = resolveConfigDir(path.join(process.cwd(), 'config'));
         if (configDir.indexOf('.') === 0) {
             configDir = path.join(process.cwd(), configDir);
         }

package/src/auth/VaultAppRoleAuth.js

@@ -27,9 +27,10 @@ class VaultAppRoleAuth extends VaultBaseAuth {
     }
 
     _authenticate() {
+        // Never log the role_id: for a role with bind_secret_id=false it is the whole login credential.
         this._log.info(
-            'making authentication request: role_id=%s',
-            this.__roleId
+            'making authentication request: approle mount=%s',
+            this._mount
         );
 
         return this.__apiClient.makeRequest('POST', `/auth/${this._mount}/login`, {

package/src/auth/VaultBaseAuth.js

@@ -10,6 +10,7 @@ const AuthToken = require('./AuthToken');
 /** Renew at the halfway point of the token's remaining lifetime. */
 const DEFAULT_RENEWAL_FRACTION = 0.5;
 const errors = require('../errors');
+const safeMessage = require('../safeMessage');
 
 /**
  * Formats a millisecond duration as a short human-readable string
@@ -285,8 +286,14 @@ class VaultBaseAuth {
                 }
                 this.__setupTokenRefreshTimer(authToken);
 
-                this._log.error(`Cannot refresh auth token with "${authToken.getAccessor()}" accessor. Error: ${err.message}`);
-                this._log.error(err);
+                const message = `Cannot refresh auth token with "${authToken.getAccessor()}" accessor.`;
+                // Dumping a VaultHttpError would print its raw response body, so it gets the safe
+                // message only. Any other error is logged whole: its stack already has the message.
+                if (err instanceof errors.VaultHttpError) {
+                    this._log.error(`${message} Error: ${safeMessage(err)}`);
+                } else {
+                    this._log.error(message, err);
+                }
             });
         }, timer);
 
@@ -313,7 +320,7 @@ class VaultBaseAuth {
                 return this._getTokenEntity(authToken.getId());
             })
             .catch((reason) => {
-                this._log.error('token renew failed: %s', reason.message);
+                this._log.error('token renew failed: %s', safeMessage(reason));
                 throw reason;
             });
     }

package/src/auth/VaultJwtAuth.js

@@ -21,6 +21,15 @@ class VaultJwtAuth extends VaultBaseAuth {
      *   returning `string | Promise<string>`. Called fresh on every login (never at construction
      *   or cached across logins) so it can mint a short-lived token -- the shape GitHub Actions'
      *   `core.getIDToken()`, cloud metadata endpoints and SPIFFE workloads need.
+     * @param {String} [config.distributedClaimAccessToken] - A literal OAuth access token forwarded
+     *   to Vault as `distributed_claim_access_token`. Azure/Entra roles with `fetch_groups` enabled
+     *   need it so Vault can resolve the distributed group-membership claim against the Microsoft
+     *   Graph API. Optional, and mutually exclusive with `distributedClaimAccessTokenProvider`.
+     * @param {Function} [config.distributedClaimAccessTokenProvider] - (optionally async) function
+     *   invoked at login time, returning `string | Promise<string>`. Called fresh on every login
+     *   (never at construction or cached across logins) because Graph access tokens are short-lived
+     *   and are usually acquired next to the JWT itself. Mutually exclusive with
+     *   `distributedClaimAccessToken`.
      * @param {String} [config.namespace] - Optional. Vault namespace. Applied as the X-Vault-Namespace
      *   header to every request by {@link VaultApiClient}; see {@link VaultClient#constructor}.
      * @param {String} mount - Vault's mount point ("jwt" by default)
@@ -37,34 +46,57 @@ class VaultJwtAuth extends VaultBaseAuth {
         if (config.jwtProvider !== undefined && typeof config.jwtProvider !== 'function') {
             throw new errors.InvalidArgumentsError('"jwtProvider" should be a function for VaultJwtAuth');
         }
+        if (config.distributedClaimAccessToken !== undefined
+            && config.distributedClaimAccessTokenProvider !== undefined) {
+            throw new errors.InvalidArgumentsError(
+                'Only one of "distributedClaimAccessToken" or "distributedClaimAccessTokenProvider"'
+                + ' should be provided for VaultJwtAuth'
+            );
+        }
+        if (config.distributedClaimAccessTokenProvider !== undefined
+            && typeof config.distributedClaimAccessTokenProvider !== 'function') {
+            throw new errors.InvalidArgumentsError(
+                '"distributedClaimAccessTokenProvider" should be a function for VaultJwtAuth'
+            );
+        }
 
         this.__role = config.role;
         this.__jwt = config.jwt;
         this.__jwtPath = config.jwtPath;
         this.__jwtProvider = config.jwtProvider;
+        this.__distributedClaimAccessToken = config.distributedClaimAccessToken;
+        this.__distributedClaimAccessTokenProvider = config.distributedClaimAccessTokenProvider;
     }
 
     _authenticate() {
         return Promise.resolve()
             .then(() => this.__acquireJwt())
-            .then(({ jwt, source }) => {
-                this._log.info(
-                    'making authentication request: Vault role: "%s"; JWT source: %s (%d bytes)',
-                    this.__role !== undefined ? this.__role : '(default_role)', source, jwt.length
-                );
+            .then(({ jwt, source }) => Promise.resolve()
+                .then(() => this.__acquireDistributedClaimAccessToken())
+                .then((distributedClaim) => {
+                    this._log.info(
+                        'making authentication request: Vault role: "%s"; JWT source: %s (%d bytes)%s',
+                        this.__role !== undefined ? this.__role : '(default_role)', source, jwt.length,
+                        distributedClaim === undefined
+                            ? ''
+                            : `; distributed claim access token: ${distributedClaim.source}`
+                    );
 
-                const body = { jwt };
-                if (this.__role !== undefined) {
-                    body.role = this.__role;
-                }
+                    const body = { jwt };
+                    if (this.__role !== undefined) {
+                        body.role = this.__role;
+                    }
+                    if (distributedClaim !== undefined) {
+                        body.distributed_claim_access_token = distributedClaim.accessToken;
+                    }
 
-                return this.__apiClient.makeRequest('POST', `/auth/${this._mount}/login`, body)
-                    .then((res) => {
-                        this._log.debug('received Vault client token from JWT login');
+                    return this.__apiClient.makeRequest('POST', `/auth/${this._mount}/login`, body)
+                        .then((res) => {
+                            this._log.debug('received Vault client token from JWT login');
 
-                        return this._getTokenEntity(res.auth.client_token);
-                    });
-            });
+                            return this._getTokenEntity(res.auth.client_token);
+                        });
+                }));
     }
 
     /**
@@ -90,6 +122,33 @@ class VaultJwtAuth extends VaultBaseAuth {
             return { jwt, source: 'provider' };
         });
     }
+
+    /**
+     * Resolves to `undefined` when neither option is configured, so that the login body stays
+     * byte-identical to what it was before this option existed.
+     *
+     * @returns {undefined|{accessToken: String, source: String}|Promise<{accessToken: String, source: String}>}
+     * @private
+     */
+    __acquireDistributedClaimAccessToken() {
+        if (this.__distributedClaimAccessToken !== undefined) {
+            return { accessToken: this.__distributedClaimAccessToken, source: 'literal' };
+        }
+        if (this.__distributedClaimAccessTokenProvider === undefined) {
+            return undefined;
+        }
+
+        // Wrapping in Promise.resolve().then() normalizes both a sync provider (plain return)
+        // and a synchronous throw into the same rejection path as an async one.
+        return Promise.resolve().then(() => this.__distributedClaimAccessTokenProvider()).then((accessToken) => {
+            if (typeof accessToken !== 'string' || accessToken.length === 0) {
+                throw new errors.InvalidArgumentsError(
+                    '"distributedClaimAccessTokenProvider" must resolve to a non-empty access token string'
+                );
+            }
+            return { accessToken, source: 'provider' };
+        });
+    }
 }
 
 module.exports = VaultJwtAuth;

package/src/kvTransform.js

@@ -8,6 +8,8 @@
  * normalizeResponse(version, op, body)         -> normalized body
  */
 
+const { trimTrailingSlashes } = require('./slashes');
+
 // Map of op -> v2 path segment inserted between mount and logical path.
 const V2_SEGMENT = {
     read:            'data',
@@ -33,7 +35,7 @@ const V2_SEGMENT = {
  */
 function rewritePath(version, op, mount, logicalPath) {
     // Normalise trailing slash on mount
-    const m = mount.replace(/\/+$/, '');
+    const m = trimTrailingSlashes(mount);
 
     if (version !== 2) {
         // v1 / non-kv: simple concatenation

package/src/safeMessage.js

@@ -0,0 +1,32 @@
+'use strict';
+
+const { VaultHttpError } = require('./errors');
+
+/**
+ * A message for `err` that is safe to log or to embed in another error's message.
+ *
+ * A {@link VaultHttpError}'s own message is `"<status> - <raw body text>"` (kept for
+ * compatibility), and a non-2xx Vault body can still carry secret material: a transit batch
+ * decrypt with one bad item answers 400 with the other items' plaintexts in
+ * `data.batch_results`. So for those only the status and Vault's own `errors` strings are
+ * kept. Any other error's message is returned unchanged, and a rejection value that is not an
+ * error (`undefined`, a string) is stringified, so the catch handler logging it cannot throw.
+ *
+ * @param {*} err
+ * @returns {string}
+ */
+function safeMessage(err) {
+    if (!(err instanceof VaultHttpError)) {
+        return err && err.message !== undefined ? err.message : String(err);
+    }
+
+    const body = err.error;
+    if (!body || !Array.isArray(body.errors)) {
+        return `${err.statusCode} - (response body omitted)`;
+    }
+
+    const vaultErrors = body.errors.filter((e) => typeof e === 'string');
+    return `${err.statusCode} - ${JSON.stringify({ errors: vaultErrors })}`;
+}
+
+module.exports = safeMessage;

package/src/slashes.js

@@ -0,0 +1,32 @@
+'use strict';
+
+// Slash trimming without a regex: /\/+$/ is tried at every position of a run of slashes, so it is
+// quadratic on a long run that does not end the string ('a' + '/'.repeat(40000) + 'x' takes
+// half a second), and its inputs (namespace, engines keys, paths, detection responses) come from
+// outside the library (CodeQL js/polynomial-redos).
+
+/**
+ * @param {string} value
+ * @returns {string} `value` without trailing slashes
+ */
+function trimTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value[end - 1] === '/') {
+        end--;
+    }
+    return value.slice(0, end);
+}
+
+/**
+ * @param {string} value
+ * @returns {string} `value` without leading or trailing slashes
+ */
+function trimSlashes(value) {
+    let start = 0;
+    while (start < value.length && value[start] === '/') {
+        start++;
+    }
+    return trimTrailingSlashes(value.slice(start));
+}
+
+module.exports = { trimTrailingSlashes, trimSlashes };