pi-kiosk-shared 2.1.47 → 2.1.49

package/dist/clientLogRedaction.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Client log metadata redaction (enterprise hardening v1.2.3).
+ * Used by admin, kiosk, and customer structured loggers before console transport.
+ */
+/** Redact tokens, emails, and card-like digit runs in free-text log messages. */
+export declare function redactStringSecrets(value: string): string;
+/** Redact structured metadata before console transport or JSON log lines. */
+export declare function redactClientLogMeta(meta: Record<string, unknown> | undefined): Record<string, unknown> | undefined;
+//# sourceMappingURL=clientLogRedaction.d.ts.map

package/dist/clientLogRedaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientLogRedaction.d.ts","sourceRoot":"","sources":["../src/clientLogRedaction.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA8CH,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD;AAoCD,6EAA6E;AAC7E,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACxC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAKrC"}

package/dist/clientLogRedaction.js

@@ -0,0 +1,96 @@
+/**
+ * Client log metadata redaction (enterprise hardening v1.2.3).
+ * Used by admin, kiosk, and customer structured loggers before console transport.
+ */
+const SENSITIVE_KEYS = new Set([
+    'apitoken',
+    'apiToken',
+    'token',
+    'authorization',
+    'authtoken',
+    'authToken',
+    'sessiontoken',
+    'sessionToken',
+    'refreshtoken',
+    'refreshToken',
+    'accesstoken',
+    'accessToken',
+    'password',
+    'secret',
+    'credentialsecret',
+    'credentialsSecret',
+    'accountslug',
+    'accountSlug',
+    'errortext',
+    'errorText',
+    'responsebody',
+    'responseBody',
+    'rawbody',
+    'rawBody',
+    'customeremail',
+    'customerEmail',
+    'email',
+    'phone',
+    'phonenumber',
+    'phoneNumber',
+    'code',
+    'otp',
+    'cardnumber',
+    'cardNumber',
+    'pan',
+]);
+const MAX_DEPTH = 4;
+function isSensitiveKey(key) {
+    return SENSITIVE_KEYS.has(key) || SENSITIVE_KEYS.has(key.toLowerCase());
+}
+/** Redact tokens, emails, and card-like digit runs in free-text log messages. */
+export function redactStringSecrets(value) {
+    let out = value;
+    out = out.replace(/(Bearer\s+)[A-Za-z0-9._-]{16,}/gi, '$1[REDACTED]');
+    out = out.replace(/([?&](?:apiToken|token|api_key|apikey)=)([^&\s]+)/gi, '$1[REDACTED]');
+    out = out.replace(/\b\d{13,19}\b/g, '[REDACTED_PII]');
+    out = out.replace(/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, '[REDACTED_EMAIL]');
+    return out;
+}
+function redactValue(value, depth) {
+    if (depth > MAX_DEPTH) {
+        return '[REDACTED_DEPTH]';
+    }
+    if (value === null || value === undefined) {
+        return value;
+    }
+    if (typeof value === 'string') {
+        return redactStringSecrets(value);
+    }
+    if (value instanceof Error) {
+        return {
+            name: value.name,
+            message: redactStringSecrets(value.message),
+        };
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => redactValue(item, depth + 1));
+    }
+    if (typeof value === 'object') {
+        const record = value;
+        const out = {};
+        for (const [key, nested] of Object.entries(record)) {
+            if (isSensitiveKey(key)) {
+                out[key] = '[REDACTED]';
+            }
+            else {
+                out[key] = redactValue(nested, depth + 1);
+            }
+        }
+        return out;
+    }
+    return value;
+}
+/** Redact structured metadata before console transport or JSON log lines. */
+export function redactClientLogMeta(meta) {
+    if (meta === undefined) {
+        return undefined;
+    }
+    return redactValue(meta, 0);
+}
+//# sourceMappingURL=clientLogRedaction.js.map

package/dist/clientLogRedaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientLogRedaction.js","sourceRoot":"","sources":["../src/clientLogRedaction.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,UAAU;IACV,UAAU;IACV,OAAO;IACP,eAAe;IACf,WAAW;IACX,WAAW;IACX,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,aAAa;IACb,aAAa;IACb,UAAU;IACV,QAAQ;IACR,kBAAkB;IAClB,mBAAmB;IACnB,aAAa;IACb,aAAa;IACb,WAAW;IACX,WAAW;IACX,cAAc;IACd,cAAc;IACd,SAAS;IACT,SAAS;IACT,eAAe;IACf,eAAe;IACf,OAAO;IACP,OAAO;IACP,aAAa;IACb,aAAa;IACb,MAAM;IACN,KAAK;IACL,YAAY;IACZ,YAAY;IACZ,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,kCAAkC,EAAE,cAAc,CAAC,CAAC;IACtE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,qDAAqD,EAAE,cAAc,CAAC,CAAC;IACzF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IACtD,GAAG,GAAG,GAAG,CAAC,OAAO,CACf,iDAAiD,EACjD,kBAAkB,CACnB,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa;IAChD,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;SAC5C,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CACjC,IAAyC;IAEzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,CAA4B,CAAC;AACzD,CAAC"}

package/dist/index.d.ts

@@ -31,4 +31,5 @@ export * from './auditMetadataDisplayFields.js';
 export * from './complianceDevCaps.js';
 export * from './customerFailureRecovery.js';
 export * from './labels/localizedLabel.js';
+export * from './clientLogRedaction.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,cAAc,YAAY,CAAC;AAC3B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,cAAc,YAAY,CAAC;AAC3B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC"}

package/dist/index.js

@@ -31,4 +31,5 @@ export * from './auditMetadataDisplayFields.js';
 export * from './complianceDevCaps.js';
 export * from './customerFailureRecovery.js';
 export * from './labels/localizedLabel.js';
+export * from './clientLogRedaction.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,cAAc,YAAY,CAAC;AAC3B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,4BAA4B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,cAAc,YAAY,CAAC;AAC3B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-kiosk-shared",
-  "version": "2.1.47",
+  "version": "2.1.49",
   "type": "module",
   "private": false,
   "description": "Shared types, API contracts, and error classes for Pi Kiosk system",
@@ -59,6 +59,11 @@
       "import": "./dist/analyticsConsentAllowlist.js",
       "require": "./dist/analyticsConsentAllowlist.js",
       "types": "./dist/analyticsConsentAllowlist.d.ts"
+    },
+    "./clientLogRedaction": {
+      "import": "./dist/clientLogRedaction.js",
+      "require": "./dist/clientLogRedaction.js",
+      "types": "./dist/clientLogRedaction.d.ts"
     }
   },
   "scripts": {