sermon-js 0.2.0 → 0.3.0

package/README.md

@@ -110,6 +110,7 @@ type CheckOutcome = {
   metrics?: Record<string, string | number>;                        // small chips
   usage?: { label; used; limit; unit?; resetsAt? }[];               // quota bars
   instances?: { key; region?; state?; status; latencyMs?; error? }[]; // per machine/region
+  instanceLabels?: { key; detail? };                                  // what the instances are: "Model", "Compute"…
   probed?: boolean;        // false when the target was deliberately not touched
 };
 ```
@@ -230,7 +231,7 @@ hooks and helpers to build your own. See [UI kit](docs/ui.md) and
 - [x] Host-agnostic scheduling: `tick()`, `startScheduler`, `/tick`, refresh on read
 - [x] HTTP API handler, Node adapter
 - [x] Stores: memory, Upstash REST, any Redis client
-- [x] Presets: Fly apps (sleep-safe, per region), GCP instances, AWS/S3, Statuspage, Pusher, AI/translation/video/email/search providers, Vercel, MongoDB, Redis, PostgreSQL
+- [x] Presets: Fly apps (sleep-safe, per region), GCP instances, Neon projects (sleep-safe), AWS/S3/Bedrock, Statuspage, Pusher, Stripe, AI/translation/video/email/search providers, Vercel, MongoDB, Redis, PostgreSQL
 - [x] Stores: SQL (Postgres, MySQL/MariaDB, SQLite), MongoDB
 - [x] React UI kit (headless hooks + HeroUI components)
 - [ ] First npm release

package/dist/api/index.d.cts

@@ -1,7 +1,7 @@
-import { D as Duration, S as Status } from '../status-DsWzgb9Q.cjs';
-import '../config-BEbP-uLf.cjs';
-import '../types-CctvUAs2.cjs';
-import '../store-DybhDphS.cjs';
+import { D as Duration, S as Status } from '../status-BExBb08T.cjs';
+import '../config-gro29syt.cjs';
+import '../types-BVa6vIKk.cjs';
+import '../store-CAIB7Esp.cjs';
 
 type HandlerContext = {
     /** Keeps the platform alive for background work after the response (Workers, Vercel, Netlify…) */

package/dist/api/index.d.ts

@@ -1,7 +1,7 @@
-import { D as Duration, S as Status } from '../status-zd04ZQ98.js';
-import '../config-w1tm1bdu.js';
-import '../types-CctvUAs2.js';
-import '../store-_GuzSP0z.js';
+import { D as Duration, S as Status } from '../status-DmRhwvVC.js';
+import '../config-iY18j9IA.js';
+import '../types-BVa6vIKk.js';
+import '../store-BfKP7CjW.js';
 
 type HandlerContext = {
     /** Keeps the platform alive for background work after the response (Workers, Vercel, Netlify…) */

package/dist/{chunk-PARE6EUZ.cjs → chunk-NZTKXXW2.cjs}

@@ -162,7 +162,11 @@ async function runService({
       id: instance.id === void 0 ? void 0 : redact(instance.id),
       state: instance.state === void 0 ? void 0 : redact(instance.state),
       error: sanitizeError({ message: instance.error, secretValues })
-    })) : void 0
+    })) : void 0,
+    instanceLabels: outcome.instanceLabels ? {
+      key: redact(outcome.instanceLabels.key),
+      detail: outcome.instanceLabels.detail === void 0 ? void 0 : redact(outcome.instanceLabels.detail)
+    } : void 0
   };
 }
 async function runServices({
@@ -180,5 +184,5 @@ exports.redactText = redactText;
 exports.runService = runService;
 exports.runServices = runServices;
 exports.sanitizeError = sanitizeError;
-//# sourceMappingURL=chunk-PARE6EUZ.cjs.map
-//# sourceMappingURL=chunk-PARE6EUZ.cjs.map
+//# sourceMappingURL=chunk-NZTKXXW2.cjs.map
+//# sourceMappingURL=chunk-NZTKXXW2.cjs.map

package/dist/chunk-NZTKXXW2.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sanitize.ts","../src/runner.ts"],"names":["createHttp","measure","combine","normalizeReturn","error","errorMessage"],"mappings":";;;;;AAAA,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,iBAAA,GAAoB,CAAA;AAG1B,IAAM,YAAA,GAAyB;AAAA;AAAA,EAE7B,iEAAA;AAAA;AAAA,EAEA,+DAAA;AAAA;AAAA;AAAA,EAGA,uCAAA;AAAA,EACA,+CAAA;AAAA,EACA,oCAAA;AAAA,EACA,iDAAA;AAAA,EACA,4BAAA;AAAA;AAAA,EAEA,8BAAA;AAAA,EACA,4BAAA;AAAA,EACA;AACF,CAAA;AAOO,SAAS,oBAAoB,OAAA,EAAiD;AACnF,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAY;AAC/B,EAAA,MAAM,MAAA,GAAS,CAAC,KAAA,KAAkB;AAChC,IAAA,IAAI,KAAA,CAAM,MAAA,IAAU,iBAAA,EAAmB,MAAA,CAAO,IAAI,KAAK,CAAA;AAAA,EACzD,CAAA;AACA,EAAA,MAAM,GAAA,GAAM,CAAC,KAAA,KAAmB;AAC9B,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,SAAS,iBAAA,EAAmB;AACnE,IAAA,MAAA,CAAO,KAAK,CAAA;AAEZ,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,kBAAA,CAAmB,KAAK,CAAC,CAAA;AAAA,IAClC,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAA,CAAO,KAAK,SAAA,CAAU,KAAK,EAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AACzC,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA;AAAA,IACvC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF,CAAA;AACA,EAAA,MAAM,IAAA,GAAO,CAAC,KAAA,KAAmB;AAC/B,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,GAAA,CAAI,KAAK,CAAA;AAAA,SAAA,IAC/B,MAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,KAAA,CAAM,QAAQ,IAAI,CAAA;AAAA,SAAA,IACxC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,SAAiB,MAAA,CAAO,KAAK,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA,EAChF,CAAA;AACA,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,GAAA,CAAI,MAAM,CAAA;AACV,IAAA,IAAI,MAAA,CAAO,SAAA,EAAU,CAAE,UAAA,CAAW,GAAG,CAAA,EAAG;AACtC,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,MAAM,CAAC,CAAA;AAAA,MACzB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,MAAM,WAAA,GAAc,iDAAA,CAAkD,IAAA,CAAK,MAAM,CAAA;AACjF,IAAA,KAAA,MAAW,QAAQ,WAAA,EAAa,KAAA,CAAM,CAAC,CAAA,IAAK,EAAC,EAAG;AAC9C,MAAA,GAAA,CAAI,IAAI,CAAA;AACR,MAAA,IAAI;AACF,QAAA,GAAA,CAAI,kBAAA,CAAmB,IAAI,CAAC,CAAA;AAAA,MAC9B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,CAAC,GAAG,MAAM,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,MAAA,GAAS,CAAA,CAAE,MAAM,CAAA;AACvD;AAOO,SAAS,UAAA,CAAW,EAAE,IAAA,EAAM,YAAA,EAAa,EAAqD;AACnG,EAAA,IAAI,GAAA,GAAM,IAAA;AACV,EAAA,KAAA,MAAW,MAAA,IAAU,cAAc,GAAA,GAAM,GAAA,CAAI,MAAM,MAAM,CAAA,CAAE,KAAK,KAAK,CAAA;AACrE,EAAA,GAAA,GAAM,GAAA,CAEH,OAAA,CAAQ,uCAAA,EAAyC,QAAQ,CAAA,CAEzD,OAAA,CAAQ,8CAAA,EAAgD,QAAQ,CAAA,CAEhE,OAAA,CAAQ,mEAAA,EAAqE,QAAQ,CAAA;AACxF,EAAA,KAAA,MAAW,WAAW,YAAA,EAAc,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,SAAS,KAAK,CAAA;AACpE,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,aAAA,CAAc;AAAA,EAC5B,OAAA;AAAA,EACA;AACF,CAAA,EAGuB;AACrB,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,MAAM,MAAM,UAAA,CAAW,EAAE,IAAA,EAAM,OAAA,EAAS,cAAc,CAAA;AACtD,EAAA,OAAO,GAAA,CAAI,SAAS,UAAA,GAAa,CAAA,EAAG,IAAI,KAAA,CAAM,CAAA,EAAG,UAAU,CAAC,CAAA,MAAA,CAAA,GAAM,GAAA;AACpE;;;ACtGA,IAAM,QAAA,GAAW,GAAA;AAoBjB,eAAsB,UAAA,CAAW;AAAA,EAC/B,OAAA;AAAA,EACA,YAAA;AAAA,EACA,KAAA;AAAA,EACA,GAAA,GAAM,MAAM,IAAA,CAAK,GAAA,EAAI;AAAA,EACrB,KAAA,EAAO,SAAA;AAAA,EACP;AACF,CAAA,EAA4C;AAC1C,EAAA,MAAM,YAAY,GAAA,EAAI;AACtB,EAAA,IAAI,OAAA,CAAQ,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AAC9B,IAAA,OAAO,EAAE,KAAK,OAAA,CAAQ,GAAA,EAAK,QAAQ,cAAA,EAAgB,SAAA,EAAW,QAAQ,KAAA,EAAM;AAAA,EAC9E;AAEA,EAAA,MAAM,SAAS,CAAC,IAAA,KAAiB,WAAW,EAAE,IAAA,EAAM,cAAc,CAAA;AAClE,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,GAAA,GAAkC;AAAA,IACtC,SAAS,OAAA,CAAQ,OAAA;AAAA,IACjB,IAAA,EAAMA,4BAAA,CAAW,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAW,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,KAAA,EAAO,SAAA,EAAW,MAAA,EAAQ,oBAAoB,CAAA;AAAA,aAC1HC,yBAAA;AAAA,aACAC,yBAAA;AAAA,IACA,QAAQ,UAAA,CAAW,MAAA;AAAA,IACnB,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,KAAA;AAAA,IACA,GAAA,EAAK;AAAA,GACP;AAEA,EAAA,MAAM,KAAA,GAAQ,YAAY,GAAA,EAAI;AAC9B,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,IAAA,CAAK;AAAA,MAClC,OAAA,CAAQ,SAAQ,CAAE,IAAA,CAAK,MAAM,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAC,CAAA;AAAA,MAC/C,IAAI,OAAA,CAAe,CAAC,CAAA,EAAG,MAAA,KAAW;AAChC,QAAA,KAAA,GAAQ,WAAW,MAAM;AACvB,UAAA,UAAA,CAAW,KAAA,CAAM,IAAI,YAAA,CAAa,WAAA,EAAa,cAAc,CAAC,CAAA;AAC9D,UAAA,MAAA,CAAO,IAAI,YAAA,CAAa,WAAA,EAAa,cAAc,CAAC,CAAA;AAAA,QACtD,CAAA,EAAG,OAAA,CAAQ,SAAA,GAAY,QAAQ,CAAA;AAAA,MACjC,CAAC;AAAA,KACF,CAAA;AACD,IAAA,OAAA,GAAUC,kCAAgB,QAAQ,CAAA;AAClC,IAAA,IAAI,OAAA,CAAQ,cAAc,KAAA,CAAA,IAAa,OAAA,CAAQ,WAAW,KAAA,IAAS,OAAA,CAAQ,WAAW,UAAA,EAAY;AAEhG,MAAA,OAAA,GAAU,EAAE,GAAG,OAAA,EAAS,SAAA,EAAW,IAAA,CAAK,MAAM,WAAA,CAAY,GAAA,EAAI,GAAI,KAAK,CAAA,EAAE;AAAA,IAC3E;AAAA,EACF,SAASC,MAAAA,EAAO;AACd,IAAA,OAAA,GAAU,EAAE,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAOC,8BAAA,CAAaD,MAAK,CAAA,EAAE;AAAA,EACzD,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,KAAK,CAAA;AAAA,EACpB;AAEA,EAAA,IAAI,EAAE,MAAA,EAAQ,KAAA,EAAM,GAAI,OAAA;AACxB,EAAA,IAAI,MAAA,KAAW,QAAQ,OAAA,CAAQ,SAAA,KAAc,UAAa,OAAA,CAAQ,SAAA,GAAY,QAAQ,MAAA,EAAQ;AAC5F,IAAA,MAAA,GAAS,UAAA;AACT,IAAA,KAAA,KAAU,CAAA,eAAA,EAAkB,OAAA,CAAQ,SAAS,CAAA,eAAA,EAAkB,QAAQ,MAAM,CAAA,IAAA,CAAA;AAAA,EAC/E;AAEA,EAAA,OAAO;AAAA,IACL,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,MAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA,EAAQ,QAAQ,MAAA,IAAU,IAAA;AAAA,IAC1B,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,YAAY,OAAA,CAAQ,UAAA;AAAA,IACpB,OAAO,aAAA,CAAc,EAAE,OAAA,EAAS,KAAA,EAAO,cAAc,CAAA;AAAA;AAAA,IAErD,OAAA,EAAS,OAAA,CAAQ,OAAA,GACb,MAAA,CAAO,WAAA;AAAA,MACL,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA,CAAE,IAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,KAAM;AAAA,QACrD,OAAO,IAAI,CAAA;AAAA,QACX,OAAO,KAAA,KAAU,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI;AAAA,OAC7C;AAAA,KACH,GACA,MAAA;AAAA,IACJ,KAAA,EAAO,QAAQ,KAAA,EAAO,MAAA,GAClB,QAAQ,KAAA,CAAM,GAAA,CAAI,CAAC,KAAA,MAAW;AAAA,MAC5B,GAAG,KAAA;AAAA,MACH,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,KAAK,CAAA;AAAA,MACzB,MAAM,KAAA,CAAM,IAAA,KAAS,SAAY,MAAA,GAAY,MAAA,CAAO,MAAM,IAAI;AAAA,MAC9D,CAAA,GACF,MAAA;AAAA,IACJ,SAAA,EAAW,QAAQ,SAAA,EAAW,MAAA,GAC1B,QAAQ,SAAA,CAAU,GAAA,CAAI,CAAC,QAAA,MAAc;AAAA,MACnC,GAAG,QAAA;AAAA,MACH,GAAA,EAAK,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA;AAAA,MACxB,QAAQ,QAAA,CAAS,MAAA,KAAW,SAAY,MAAA,GAAY,MAAA,CAAO,SAAS,MAAM,CAAA;AAAA,MAC1E,IAAI,QAAA,CAAS,EAAA,KAAO,SAAY,MAAA,GAAY,MAAA,CAAO,SAAS,EAAE,CAAA;AAAA,MAC9D,OAAO,QAAA,CAAS,KAAA,KAAU,SAAY,MAAA,GAAY,MAAA,CAAO,SAAS,KAAK,CAAA;AAAA,MACvE,OAAO,aAAA,CAAc,EAAE,SAAS,QAAA,CAAS,KAAA,EAAO,cAAc;AAAA,MAC9D,CAAA,GACF,MAAA;AAAA,IACJ,cAAA,EAAgB,QAAQ,cAAA,GACpB;AAAA,MACE,GAAA,EAAK,MAAA,CAAO,OAAA,CAAQ,cAAA,CAAe,GAAG,CAAA;AAAA,MACtC,MAAA,EAAQ,QAAQ,cAAA,CAAe,MAAA,KAAW,SAAY,MAAA,GAAY,MAAA,CAAO,OAAA,CAAQ,cAAA,CAAe,MAAM;AAAA,KACxG,GACA;AAAA,GACN;AACF;AAEA,eAAsB,WAAA,CAAY;AAAA,EAChC,QAAA;AAAA,EACA,QAAA;AAAA,EACA,GAAG;AACL,CAAA,EAI2B;AACzB,EAAA,OAAO,OAAA,CAAQ,GAAA;AAAA,IACb,QAAA,CAAS,GAAA,CAAI,CAAC,OAAA,KAAY,WAAW,EAAE,OAAA,EAAS,KAAA,EAAO,QAAA,CAAS,QAAQ,GAAG,CAAA,EAAG,GAAG,IAAA,EAAM,CAAC;AAAA,GAC1F;AACF","file":"chunk-NZTKXXW2.cjs","sourcesContent":["const MAX_LENGTH = 300;\nconst MIN_SECRET_LENGTH = 6;\n\n/** Shapes of well-known credentials, redacted even when the value was never declared as a secret */\nconst KEY_PATTERNS: RegExp[] = [\n  // PEM blocks (private keys, certificates), whole or cut short\n  /-----BEGIN [A-Z0-9 ]+-----[\\s\\S]*?(-----END [A-Z0-9 ]+-----|$)/g,\n  // JSON Web Tokens (OAuth access and identity tokens)\n  /\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}(\\.[A-Za-z0-9_-]*)?/g,\n  // Prefixed API keys: OpenAI/Anthropic/Stripe (sk-, pk_, rk_), GitHub, Slack, Fly, MailerSend.\n  // \"*\" is included because providers echo keys back partly masked (sk-proj-****abcd).\n  /\\b(sk|pk|rk)[-_][A-Za-z0-9_*.-]{12,}/g,\n  /\\b(gh[pousr]_|github_pat_)[A-Za-z0-9_*]{12,}/g,\n  /\\bxox[abeoprs]-[A-Za-z0-9*-]{10,}/g,\n  /\\b(FlyV1 |fm[12]_|fo1_)[A-Za-z0-9+/=_,*-]{12,}/g,\n  /\\bmlsn\\.[A-Za-z0-9*]{12,}/g,\n  // AWS access key ids, Google API keys, Google OAuth tokens\n  /\\b(AKIA|ASIA)[0-9A-Z*]{12,}/g,\n  /\\bAIza[0-9A-Za-z_*-]{20,}/g,\n  /\\bya29\\.[0-9A-Za-z_*.-]{12,}/g,\n];\n\n/**\n * Every value worth redacting from a set of secrets: the values themselves, the string fields\n * of JSON secrets (e.g. the private key inside a service-account JSON), the user and password\n * of connection strings, and the encoded forms a value takes in URLs, JSON and Basic auth.\n */\nexport function collectSecretValues(secrets: Iterable<string | undefined>): string[] {\n  const values = new Set<string>();\n  const addOne = (value: string) => {\n    if (value.length >= MIN_SECRET_LENGTH) values.add(value);\n  };\n  const add = (value: unknown) => {\n    if (typeof value !== \"string\" || value.length < MIN_SECRET_LENGTH) return;\n    addOne(value);\n    // The same value as it appears in a URL, inside JSON, and base64-encoded\n    try {\n      addOne(encodeURIComponent(value));\n    } catch {\n      // Lone surrogates can't be encoded: the raw value is still covered\n    }\n    addOne(JSON.stringify(value).slice(1, -1));\n    try {\n      addOne(btoa(value).replace(/=+$/, \"\"));\n    } catch {\n      // Not Latin-1: no base64 form to worry about\n    }\n  };\n  const walk = (value: unknown) => {\n    if (typeof value === \"string\") add(value);\n    else if (Array.isArray(value)) value.forEach(walk);\n    else if (value && typeof value === \"object\") Object.values(value).forEach(walk);\n  };\n  for (const secret of secrets) {\n    if (!secret) continue;\n    add(secret);\n    if (secret.trimStart().startsWith(\"{\")) {\n      try {\n        walk(JSON.parse(secret));\n      } catch {\n        // Not JSON: the whole value is already covered\n      }\n    }\n    // Connection strings: drivers report the user or the password on their own\n    const credentials = /^[a-z][a-z0-9+.-]*:\\/\\/([^\\s/@:]*):([^\\s/@]*)@/i.exec(secret);\n    for (const part of credentials?.slice(1) ?? []) {\n      add(part);\n      try {\n        add(decodeURIComponent(part));\n      } catch {\n        // Not percent-encoded\n      }\n    }\n  }\n  // Longest first, so a secret containing another one is fully redacted\n  return [...values].sort((a, b) => b.length - a.length);\n}\n\n/**\n * Strip secret values, URL credentials, query strings, bearer-like tokens and anything shaped\n * like a well-known credential. Safe for text of any length: nothing is cut here, so a secret\n * can never be half-removed.\n */\nexport function redactText({ text, secretValues }: { text: string; secretValues: string[] }): string {\n  let out = text;\n  for (const secret of secretValues) out = out.split(secret).join(\"***\");\n  out = out\n    // user:pass@host\n    .replace(/(\\b[a-z][a-z0-9+.-]*:\\/\\/)[^\\s/@]+@/gi, \"$1***@\")\n    // query strings\n    .replace(/(\\b(?:https?|wss?):\\/\\/[^\\s?]+)\\?[^\\s\"')]*/gi, \"$1?***\")\n    // bearer-ish tokens that slipped through\n    .replace(/\\b(Bearer|Token|Basic|DeepL-Auth-Key)\\s+[A-Za-z0-9._~+/=*-]{8,}/gi, \"$1 ***\");\n  for (const pattern of KEY_PATTERNS) out = out.replace(pattern, \"***\");\n  return out;\n}\n\n/** Errors are shown on public pages: redact, then truncate (in that order) */\nexport function sanitizeError({\n  message,\n  secretValues,\n}: {\n  message: string | undefined;\n  secretValues: string[];\n}): string | undefined {\n  if (!message) return undefined;\n  const out = redactText({ text: message, secretValues });\n  return out.length > MAX_LENGTH ? `${out.slice(0, MAX_LENGTH)}…` : out;\n}\n","import type { ResolvedService } from \"./config\";\nimport { combine, createHttp, errorMessage, measure, normalizeReturn } from \"./probe\";\nimport { redactText, sanitizeError } from \"./sanitize\";\nimport type { CheckCache, CheckContext, CheckOutcome, CheckResult, SecretsInput } from \"./types\";\n\n/** Extra time after `timeoutMs` before a check that ignores its abort signal is given up on */\nconst GRACE_MS = 1000;\n\nexport type RunServiceOptions = {\n  service: ResolvedService;\n  /** Every secret value of the whole configuration, for redaction */\n  secretValues: string[];\n  cache: CheckCache;\n  now?: () => number;\n  fetch?: typeof fetch;\n  /** Report failed HTTP answers by status code only */\n  hideResponseBodies?: boolean;\n};\n\n/**\n * Run one service and apply the rules shared by all of them:\n * - missing required secrets/fields → \"unconfigured\", the check is never called\n * - a throw or a timeout → down\n * - latency above `slowMs` turns \"up\" into \"degraded\"\n * - errors and every other text of the result are redacted before they leave the runner\n */\nexport async function runService({\n  service,\n  secretValues,\n  cache,\n  now = () => Date.now(),\n  fetch: fetchImpl,\n  hideResponseBodies,\n}: RunServiceOptions): Promise<CheckResult> {\n  const checkedAt = now();\n  if (service.missing.length > 0) {\n    return { key: service.key, status: \"unconfigured\", checkedAt, probed: false };\n  }\n\n  const redact = (text: string) => redactText({ text, secretValues });\n  const controller = new AbortController();\n  const ctx: CheckContext<SecretsInput> = {\n    secrets: service.secrets as Record<string, string>,\n    http: createHttp({ timeoutMs: service.timeoutMs, signal: controller.signal, fetch: fetchImpl, redact, hideResponseBodies }),\n    measure,\n    combine,\n    signal: controller.signal,\n    timeoutMs: service.timeoutMs,\n    slowMs: service.slowMs,\n    cache,\n    now: checkedAt,\n  };\n\n  const start = performance.now();\n  let outcome: CheckOutcome;\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    const returned = await Promise.race([\n      Promise.resolve().then(() => service.check(ctx)),\n      new Promise<never>((_, reject) => {\n        timer = setTimeout(() => {\n          controller.abort(new DOMException(\"Timed out\", \"TimeoutError\"));\n          reject(new DOMException(\"Timed out\", \"TimeoutError\"));\n        }, service.timeoutMs + GRACE_MS);\n      }),\n    ]);\n    outcome = normalizeReturn(returned);\n    if (outcome.latencyMs === undefined && outcome.probed !== false && outcome.status !== \"sleeping\") {\n      // Checks that don't measure themselves get the wall time of the whole check\n      outcome = { ...outcome, latencyMs: Math.round(performance.now() - start) };\n    }\n  } catch (error) {\n    outcome = { status: \"down\", error: errorMessage(error) };\n  } finally {\n    clearTimeout(timer);\n  }\n\n  let { status, error } = outcome;\n  if (status === \"up\" && outcome.latencyMs !== undefined && outcome.latencyMs > service.slowMs) {\n    status = \"degraded\";\n    error ??= `Slow response: ${outcome.latencyMs} ms (threshold ${service.slowMs} ms)`;\n  }\n\n  return {\n    key: service.key,\n    status,\n    checkedAt,\n    probed: outcome.probed ?? true,\n    latencyMs: outcome.latencyMs,\n    httpStatus: outcome.httpStatus,\n    error: sanitizeError({ message: error, secretValues }),\n    // Everything below is public too: no text leaves the runner without being redacted\n    metrics: outcome.metrics\n      ? Object.fromEntries(\n          Object.entries(outcome.metrics).map(([name, value]) => [\n            redact(name),\n            typeof value === \"string\" ? redact(value) : value,\n          ])\n        )\n      : undefined,\n    usage: outcome.usage?.length\n      ? outcome.usage.map((usage) => ({\n          ...usage,\n          label: redact(usage.label),\n          unit: usage.unit === undefined ? undefined : redact(usage.unit),\n        }))\n      : undefined,\n    instances: outcome.instances?.length\n      ? outcome.instances.map((instance) => ({\n          ...instance,\n          key: redact(instance.key),\n          region: instance.region === undefined ? undefined : redact(instance.region),\n          id: instance.id === undefined ? undefined : redact(instance.id),\n          state: instance.state === undefined ? undefined : redact(instance.state),\n          error: sanitizeError({ message: instance.error, secretValues }),\n        }))\n      : undefined,\n    instanceLabels: outcome.instanceLabels\n      ? {\n          key: redact(outcome.instanceLabels.key),\n          detail: outcome.instanceLabels.detail === undefined ? undefined : redact(outcome.instanceLabels.detail),\n        }\n      : undefined,\n  };\n}\n\nexport async function runServices({\n  services,\n  cacheFor,\n  ...rest\n}: Omit<RunServiceOptions, \"service\" | \"cache\"> & {\n  services: ResolvedService[];\n  /** Each service gets its own cache namespace */\n  cacheFor: (key: string) => CheckCache;\n}): Promise<CheckResult[]> {\n  return Promise.all(\n    services.map((service) => runService({ service, cache: cacheFor(service.key), ...rest }))\n  );\n}\n"]}

package/dist/{chunk-2M4UBCDM.js → chunk-R7BDAQOM.js}

@@ -160,7 +160,11 @@ async function runService({
       id: instance.id === void 0 ? void 0 : redact(instance.id),
       state: instance.state === void 0 ? void 0 : redact(instance.state),
       error: sanitizeError({ message: instance.error, secretValues })
-    })) : void 0
+    })) : void 0,
+    instanceLabels: outcome.instanceLabels ? {
+      key: redact(outcome.instanceLabels.key),
+      detail: outcome.instanceLabels.detail === void 0 ? void 0 : redact(outcome.instanceLabels.detail)
+    } : void 0
   };
 }
 async function runServices({
@@ -174,5 +178,5 @@ async function runServices({
 }
 
 export { collectSecretValues, redactText, runService, runServices, sanitizeError };
-//# sourceMappingURL=chunk-2M4UBCDM.js.map
-//# sourceMappingURL=chunk-2M4UBCDM.js.map
+//# sourceMappingURL=chunk-R7BDAQOM.js.map
+//# sourceMappingURL=chunk-R7BDAQOM.js.map

package/dist/chunk-R7BDAQOM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sanitize.ts","../src/runner.ts"],"names":["error"],"mappings":";;;AAAA,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,iBAAA,GAAoB,CAAA;AAG1B,IAAM,YAAA,GAAyB;AAAA;AAAA,EAE7B,iEAAA;AAAA;AAAA,EAEA,+DAAA;AAAA;AAAA;AAAA,EAGA,uCAAA;AAAA,EACA,+CAAA;AAAA,EACA,oCAAA;AAAA,EACA,iDAAA;AAAA,EACA,4BAAA;AAAA;AAAA,EAEA,8BAAA;AAAA,EACA,4BAAA;AAAA,EACA;AACF,CAAA;AAOO,SAAS,oBAAoB,OAAA,EAAiD;AACnF,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAY;AAC/B,EAAA,MAAM,MAAA,GAAS,CAAC,KAAA,KAAkB;AAChC,IAAA,IAAI,KAAA,CAAM,MAAA,IAAU,iBAAA,EAAmB,MAAA,CAAO,IAAI,KAAK,CAAA;AAAA,EACzD,CAAA;AACA,EAAA,MAAM,GAAA,GAAM,CAAC,KAAA,KAAmB;AAC9B,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,SAAS,iBAAA,EAAmB;AACnE,IAAA,MAAA,CAAO,KAAK,CAAA;AAEZ,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,kBAAA,CAAmB,KAAK,CAAC,CAAA;AAAA,IAClC,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAA,CAAO,KAAK,SAAA,CAAU,KAAK,EAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AACzC,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA;AAAA,IACvC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF,CAAA;AACA,EAAA,MAAM,IAAA,GAAO,CAAC,KAAA,KAAmB;AAC/B,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,GAAA,CAAI,KAAK,CAAA;AAAA,SAAA,IAC/B,MAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,KAAA,CAAM,QAAQ,IAAI,CAAA;AAAA,SAAA,IACxC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,SAAiB,MAAA,CAAO,KAAK,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA,EAChF,CAAA;AACA,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,IAAI,CAAC,MAAA,EAAQ;AACb,IAAA,GAAA,CAAI,MAAM,CAAA;AACV,IAAA,IAAI,MAAA,CAAO,SAAA,EAAU,CAAE,UAAA,CAAW,GAAG,CAAA,EAAG;AACtC,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,MAAM,CAAC,CAAA;AAAA,MACzB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAEA,IAAA,MAAM,WAAA,GAAc,iDAAA,CAAkD,IAAA,CAAK,MAAM,CAAA;AACjF,IAAA,KAAA,MAAW,QAAQ,WAAA,EAAa,KAAA,CAAM,CAAC,CAAA,IAAK,EAAC,EAAG;AAC9C,MAAA,GAAA,CAAI,IAAI,CAAA;AACR,MAAA,IAAI;AACF,QAAA,GAAA,CAAI,kBAAA,CAAmB,IAAI,CAAC,CAAA;AAAA,MAC9B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,CAAC,GAAG,MAAM,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,MAAA,GAAS,CAAA,CAAE,MAAM,CAAA;AACvD;AAOO,SAAS,UAAA,CAAW,EAAE,IAAA,EAAM,YAAA,EAAa,EAAqD;AACnG,EAAA,IAAI,GAAA,GAAM,IAAA;AACV,EAAA,KAAA,MAAW,MAAA,IAAU,cAAc,GAAA,GAAM,GAAA,CAAI,MAAM,MAAM,CAAA,CAAE,KAAK,KAAK,CAAA;AACrE,EAAA,GAAA,GAAM,GAAA,CAEH,OAAA,CAAQ,uCAAA,EAAyC,QAAQ,CAAA,CAEzD,OAAA,CAAQ,8CAAA,EAAgD,QAAQ,CAAA,CAEhE,OAAA,CAAQ,mEAAA,EAAqE,QAAQ,CAAA;AACxF,EAAA,KAAA,MAAW,WAAW,YAAA,EAAc,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,SAAS,KAAK,CAAA;AACpE,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,aAAA,CAAc;AAAA,EAC5B,OAAA;AAAA,EACA;AACF,CAAA,EAGuB;AACrB,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,MAAM,MAAM,UAAA,CAAW,EAAE,IAAA,EAAM,OAAA,EAAS,cAAc,CAAA;AACtD,EAAA,OAAO,GAAA,CAAI,SAAS,UAAA,GAAa,CAAA,EAAG,IAAI,KAAA,CAAM,CAAA,EAAG,UAAU,CAAC,CAAA,MAAA,CAAA,GAAM,GAAA;AACpE;;;ACtGA,IAAM,QAAA,GAAW,GAAA;AAoBjB,eAAsB,UAAA,CAAW;AAAA,EAC/B,OAAA;AAAA,EACA,YAAA;AAAA,EACA,KAAA;AAAA,EACA,GAAA,GAAM,MAAM,IAAA,CAAK,GAAA,EAAI;AAAA,EACrB,KAAA,EAAO,SAAA;AAAA,EACP;AACF,CAAA,EAA4C;AAC1C,EAAA,MAAM,YAAY,GAAA,EAAI;AACtB,EAAA,IAAI,OAAA,CAAQ,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AAC9B,IAAA,OAAO,EAAE,KAAK,OAAA,CAAQ,GAAA,EAAK,QAAQ,cAAA,EAAgB,SAAA,EAAW,QAAQ,KAAA,EAAM;AAAA,EAC9E;AAEA,EAAA,MAAM,SAAS,CAAC,IAAA,KAAiB,WAAW,EAAE,IAAA,EAAM,cAAc,CAAA;AAClE,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,GAAA,GAAkC;AAAA,IACtC,SAAS,OAAA,CAAQ,OAAA;AAAA,IACjB,IAAA,EAAM,UAAA,CAAW,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAW,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,KAAA,EAAO,SAAA,EAAW,MAAA,EAAQ,oBAAoB,CAAA;AAAA,IAC1H,OAAA;AAAA,IACA,OAAA;AAAA,IACA,QAAQ,UAAA,CAAW,MAAA;AAAA,IACnB,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,KAAA;AAAA,IACA,GAAA,EAAK;AAAA,GACP;AAEA,EAAA,MAAM,KAAA,GAAQ,YAAY,GAAA,EAAI;AAC9B,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,IAAA,CAAK;AAAA,MAClC,OAAA,CAAQ,SAAQ,CAAE,IAAA,CAAK,MAAM,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAC,CAAA;AAAA,MAC/C,IAAI,OAAA,CAAe,CAAC,CAAA,EAAG,MAAA,KAAW;AAChC,QAAA,KAAA,GAAQ,WAAW,MAAM;AACvB,UAAA,UAAA,CAAW,KAAA,CAAM,IAAI,YAAA,CAAa,WAAA,EAAa,cAAc,CAAC,CAAA;AAC9D,UAAA,MAAA,CAAO,IAAI,YAAA,CAAa,WAAA,EAAa,cAAc,CAAC,CAAA;AAAA,QACtD,CAAA,EAAG,OAAA,CAAQ,SAAA,GAAY,QAAQ,CAAA;AAAA,MACjC,CAAC;AAAA,KACF,CAAA;AACD,IAAA,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AAClC,IAAA,IAAI,OAAA,CAAQ,cAAc,KAAA,CAAA,IAAa,OAAA,CAAQ,WAAW,KAAA,IAAS,OAAA,CAAQ,WAAW,UAAA,EAAY;AAEhG,MAAA,OAAA,GAAU,EAAE,GAAG,OAAA,EAAS,SAAA,EAAW,IAAA,CAAK,MAAM,WAAA,CAAY,GAAA,EAAI,GAAI,KAAK,CAAA,EAAE;AAAA,IAC3E;AAAA,EACF,SAASA,MAAAA,EAAO;AACd,IAAA,OAAA,GAAU,EAAE,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAO,YAAA,CAAaA,MAAK,CAAA,EAAE;AAAA,EACzD,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,KAAK,CAAA;AAAA,EACpB;AAEA,EAAA,IAAI,EAAE,MAAA,EAAQ,KAAA,EAAM,GAAI,OAAA;AACxB,EAAA,IAAI,MAAA,KAAW,QAAQ,OAAA,CAAQ,SAAA,KAAc,UAAa,OAAA,CAAQ,SAAA,GAAY,QAAQ,MAAA,EAAQ;AAC5F,IAAA,MAAA,GAAS,UAAA;AACT,IAAA,KAAA,KAAU,CAAA,eAAA,EAAkB,OAAA,CAAQ,SAAS,CAAA,eAAA,EAAkB,QAAQ,MAAM,CAAA,IAAA,CAAA;AAAA,EAC/E;AAEA,EAAA,OAAO;AAAA,IACL,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,MAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA,EAAQ,QAAQ,MAAA,IAAU,IAAA;AAAA,IAC1B,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,YAAY,OAAA,CAAQ,UAAA;AAAA,IACpB,OAAO,aAAA,CAAc,EAAE,OAAA,EAAS,KAAA,EAAO,cAAc,CAAA;AAAA;AAAA,IAErD,OAAA,EAAS,OAAA,CAAQ,OAAA,GACb,MAAA,CAAO,WAAA;AAAA,MACL,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA,CAAE,IAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,KAAM;AAAA,QACrD,OAAO,IAAI,CAAA;AAAA,QACX,OAAO,KAAA,KAAU,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI;AAAA,OAC7C;AAAA,KACH,GACA,MAAA;AAAA,IACJ,KAAA,EAAO,QAAQ,KAAA,EAAO,MAAA,GAClB,QAAQ,KAAA,CAAM,GAAA,CAAI,CAAC,KAAA,MAAW;AAAA,MAC5B,GAAG,KAAA;AAAA,MACH,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,KAAK,CAAA;AAAA,MACzB,MAAM,KAAA,CAAM,IAAA,KAAS,SAAY,MAAA,GAAY,MAAA,CAAO,MAAM,IAAI;AAAA,MAC9D,CAAA,GACF,MAAA;AAAA,IACJ,SAAA,EAAW,QAAQ,SAAA,EAAW,MAAA,GAC1B,QAAQ,SAAA,CAAU,GAAA,CAAI,CAAC,QAAA,MAAc;AAAA,MACnC,GAAG,QAAA;AAAA,MACH,GAAA,EAAK,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA;AAAA,MACxB,QAAQ,QAAA,CAAS,MAAA,KAAW,SAAY,MAAA,GAAY,MAAA,CAAO,SAAS,MAAM,CAAA;AAAA,MAC1E,IAAI,QAAA,CAAS,EAAA,KAAO,SAAY,MAAA,GAAY,MAAA,CAAO,SAAS,EAAE,CAAA;AAAA,MAC9D,OAAO,QAAA,CAAS,KAAA,KAAU,SAAY,MAAA,GAAY,MAAA,CAAO,SAAS,KAAK,CAAA;AAAA,MACvE,OAAO,aAAA,CAAc,EAAE,SAAS,QAAA,CAAS,KAAA,EAAO,cAAc;AAAA,MAC9D,CAAA,GACF,MAAA;AAAA,IACJ,cAAA,EAAgB,QAAQ,cAAA,GACpB;AAAA,MACE,GAAA,EAAK,MAAA,CAAO,OAAA,CAAQ,cAAA,CAAe,GAAG,CAAA;AAAA,MACtC,MAAA,EAAQ,QAAQ,cAAA,CAAe,MAAA,KAAW,SAAY,MAAA,GAAY,MAAA,CAAO,OAAA,CAAQ,cAAA,CAAe,MAAM;AAAA,KACxG,GACA;AAAA,GACN;AACF;AAEA,eAAsB,WAAA,CAAY;AAAA,EAChC,QAAA;AAAA,EACA,QAAA;AAAA,EACA,GAAG;AACL,CAAA,EAI2B;AACzB,EAAA,OAAO,OAAA,CAAQ,GAAA;AAAA,IACb,QAAA,CAAS,GAAA,CAAI,CAAC,OAAA,KAAY,WAAW,EAAE,OAAA,EAAS,KAAA,EAAO,QAAA,CAAS,QAAQ,GAAG,CAAA,EAAG,GAAG,IAAA,EAAM,CAAC;AAAA,GAC1F;AACF","file":"chunk-R7BDAQOM.js","sourcesContent":["const MAX_LENGTH = 300;\nconst MIN_SECRET_LENGTH = 6;\n\n/** Shapes of well-known credentials, redacted even when the value was never declared as a secret */\nconst KEY_PATTERNS: RegExp[] = [\n  // PEM blocks (private keys, certificates), whole or cut short\n  /-----BEGIN [A-Z0-9 ]+-----[\\s\\S]*?(-----END [A-Z0-9 ]+-----|$)/g,\n  // JSON Web Tokens (OAuth access and identity tokens)\n  /\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}(\\.[A-Za-z0-9_-]*)?/g,\n  // Prefixed API keys: OpenAI/Anthropic/Stripe (sk-, pk_, rk_), GitHub, Slack, Fly, MailerSend.\n  // \"*\" is included because providers echo keys back partly masked (sk-proj-****abcd).\n  /\\b(sk|pk|rk)[-_][A-Za-z0-9_*.-]{12,}/g,\n  /\\b(gh[pousr]_|github_pat_)[A-Za-z0-9_*]{12,}/g,\n  /\\bxox[abeoprs]-[A-Za-z0-9*-]{10,}/g,\n  /\\b(FlyV1 |fm[12]_|fo1_)[A-Za-z0-9+/=_,*-]{12,}/g,\n  /\\bmlsn\\.[A-Za-z0-9*]{12,}/g,\n  // AWS access key ids, Google API keys, Google OAuth tokens\n  /\\b(AKIA|ASIA)[0-9A-Z*]{12,}/g,\n  /\\bAIza[0-9A-Za-z_*-]{20,}/g,\n  /\\bya29\\.[0-9A-Za-z_*.-]{12,}/g,\n];\n\n/**\n * Every value worth redacting from a set of secrets: the values themselves, the string fields\n * of JSON secrets (e.g. the private key inside a service-account JSON), the user and password\n * of connection strings, and the encoded forms a value takes in URLs, JSON and Basic auth.\n */\nexport function collectSecretValues(secrets: Iterable<string | undefined>): string[] {\n  const values = new Set<string>();\n  const addOne = (value: string) => {\n    if (value.length >= MIN_SECRET_LENGTH) values.add(value);\n  };\n  const add = (value: unknown) => {\n    if (typeof value !== \"string\" || value.length < MIN_SECRET_LENGTH) return;\n    addOne(value);\n    // The same value as it appears in a URL, inside JSON, and base64-encoded\n    try {\n      addOne(encodeURIComponent(value));\n    } catch {\n      // Lone surrogates can't be encoded: the raw value is still covered\n    }\n    addOne(JSON.stringify(value).slice(1, -1));\n    try {\n      addOne(btoa(value).replace(/=+$/, \"\"));\n    } catch {\n      // Not Latin-1: no base64 form to worry about\n    }\n  };\n  const walk = (value: unknown) => {\n    if (typeof value === \"string\") add(value);\n    else if (Array.isArray(value)) value.forEach(walk);\n    else if (value && typeof value === \"object\") Object.values(value).forEach(walk);\n  };\n  for (const secret of secrets) {\n    if (!secret) continue;\n    add(secret);\n    if (secret.trimStart().startsWith(\"{\")) {\n      try {\n        walk(JSON.parse(secret));\n      } catch {\n        // Not JSON: the whole value is already covered\n      }\n    }\n    // Connection strings: drivers report the user or the password on their own\n    const credentials = /^[a-z][a-z0-9+.-]*:\\/\\/([^\\s/@:]*):([^\\s/@]*)@/i.exec(secret);\n    for (const part of credentials?.slice(1) ?? []) {\n      add(part);\n      try {\n        add(decodeURIComponent(part));\n      } catch {\n        // Not percent-encoded\n      }\n    }\n  }\n  // Longest first, so a secret containing another one is fully redacted\n  return [...values].sort((a, b) => b.length - a.length);\n}\n\n/**\n * Strip secret values, URL credentials, query strings, bearer-like tokens and anything shaped\n * like a well-known credential. Safe for text of any length: nothing is cut here, so a secret\n * can never be half-removed.\n */\nexport function redactText({ text, secretValues }: { text: string; secretValues: string[] }): string {\n  let out = text;\n  for (const secret of secretValues) out = out.split(secret).join(\"***\");\n  out = out\n    // user:pass@host\n    .replace(/(\\b[a-z][a-z0-9+.-]*:\\/\\/)[^\\s/@]+@/gi, \"$1***@\")\n    // query strings\n    .replace(/(\\b(?:https?|wss?):\\/\\/[^\\s?]+)\\?[^\\s\"')]*/gi, \"$1?***\")\n    // bearer-ish tokens that slipped through\n    .replace(/\\b(Bearer|Token|Basic|DeepL-Auth-Key)\\s+[A-Za-z0-9._~+/=*-]{8,}/gi, \"$1 ***\");\n  for (const pattern of KEY_PATTERNS) out = out.replace(pattern, \"***\");\n  return out;\n}\n\n/** Errors are shown on public pages: redact, then truncate (in that order) */\nexport function sanitizeError({\n  message,\n  secretValues,\n}: {\n  message: string | undefined;\n  secretValues: string[];\n}): string | undefined {\n  if (!message) return undefined;\n  const out = redactText({ text: message, secretValues });\n  return out.length > MAX_LENGTH ? `${out.slice(0, MAX_LENGTH)}…` : out;\n}\n","import type { ResolvedService } from \"./config\";\nimport { combine, createHttp, errorMessage, measure, normalizeReturn } from \"./probe\";\nimport { redactText, sanitizeError } from \"./sanitize\";\nimport type { CheckCache, CheckContext, CheckOutcome, CheckResult, SecretsInput } from \"./types\";\n\n/** Extra time after `timeoutMs` before a check that ignores its abort signal is given up on */\nconst GRACE_MS = 1000;\n\nexport type RunServiceOptions = {\n  service: ResolvedService;\n  /** Every secret value of the whole configuration, for redaction */\n  secretValues: string[];\n  cache: CheckCache;\n  now?: () => number;\n  fetch?: typeof fetch;\n  /** Report failed HTTP answers by status code only */\n  hideResponseBodies?: boolean;\n};\n\n/**\n * Run one service and apply the rules shared by all of them:\n * - missing required secrets/fields → \"unconfigured\", the check is never called\n * - a throw or a timeout → down\n * - latency above `slowMs` turns \"up\" into \"degraded\"\n * - errors and every other text of the result are redacted before they leave the runner\n */\nexport async function runService({\n  service,\n  secretValues,\n  cache,\n  now = () => Date.now(),\n  fetch: fetchImpl,\n  hideResponseBodies,\n}: RunServiceOptions): Promise<CheckResult> {\n  const checkedAt = now();\n  if (service.missing.length > 0) {\n    return { key: service.key, status: \"unconfigured\", checkedAt, probed: false };\n  }\n\n  const redact = (text: string) => redactText({ text, secretValues });\n  const controller = new AbortController();\n  const ctx: CheckContext<SecretsInput> = {\n    secrets: service.secrets as Record<string, string>,\n    http: createHttp({ timeoutMs: service.timeoutMs, signal: controller.signal, fetch: fetchImpl, redact, hideResponseBodies }),\n    measure,\n    combine,\n    signal: controller.signal,\n    timeoutMs: service.timeoutMs,\n    slowMs: service.slowMs,\n    cache,\n    now: checkedAt,\n  };\n\n  const start = performance.now();\n  let outcome: CheckOutcome;\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    const returned = await Promise.race([\n      Promise.resolve().then(() => service.check(ctx)),\n      new Promise<never>((_, reject) => {\n        timer = setTimeout(() => {\n          controller.abort(new DOMException(\"Timed out\", \"TimeoutError\"));\n          reject(new DOMException(\"Timed out\", \"TimeoutError\"));\n        }, service.timeoutMs + GRACE_MS);\n      }),\n    ]);\n    outcome = normalizeReturn(returned);\n    if (outcome.latencyMs === undefined && outcome.probed !== false && outcome.status !== \"sleeping\") {\n      // Checks that don't measure themselves get the wall time of the whole check\n      outcome = { ...outcome, latencyMs: Math.round(performance.now() - start) };\n    }\n  } catch (error) {\n    outcome = { status: \"down\", error: errorMessage(error) };\n  } finally {\n    clearTimeout(timer);\n  }\n\n  let { status, error } = outcome;\n  if (status === \"up\" && outcome.latencyMs !== undefined && outcome.latencyMs > service.slowMs) {\n    status = \"degraded\";\n    error ??= `Slow response: ${outcome.latencyMs} ms (threshold ${service.slowMs} ms)`;\n  }\n\n  return {\n    key: service.key,\n    status,\n    checkedAt,\n    probed: outcome.probed ?? true,\n    latencyMs: outcome.latencyMs,\n    httpStatus: outcome.httpStatus,\n    error: sanitizeError({ message: error, secretValues }),\n    // Everything below is public too: no text leaves the runner without being redacted\n    metrics: outcome.metrics\n      ? Object.fromEntries(\n          Object.entries(outcome.metrics).map(([name, value]) => [\n            redact(name),\n            typeof value === \"string\" ? redact(value) : value,\n          ])\n        )\n      : undefined,\n    usage: outcome.usage?.length\n      ? outcome.usage.map((usage) => ({\n          ...usage,\n          label: redact(usage.label),\n          unit: usage.unit === undefined ? undefined : redact(usage.unit),\n        }))\n      : undefined,\n    instances: outcome.instances?.length\n      ? outcome.instances.map((instance) => ({\n          ...instance,\n          key: redact(instance.key),\n          region: instance.region === undefined ? undefined : redact(instance.region),\n          id: instance.id === undefined ? undefined : redact(instance.id),\n          state: instance.state === undefined ? undefined : redact(instance.state),\n          error: sanitizeError({ message: instance.error, secretValues }),\n        }))\n      : undefined,\n    instanceLabels: outcome.instanceLabels\n      ? {\n          key: redact(outcome.instanceLabels.key),\n          detail: outcome.instanceLabels.detail === undefined ? undefined : redact(outcome.instanceLabels.detail),\n        }\n      : undefined,\n  };\n}\n\nexport async function runServices({\n  services,\n  cacheFor,\n  ...rest\n}: Omit<RunServiceOptions, \"service\" | \"cache\"> & {\n  services: ResolvedService[];\n  /** Each service gets its own cache namespace */\n  cacheFor: (key: string) => CheckCache;\n}): Promise<CheckResult[]> {\n  return Promise.all(\n    services.map((service) => runService({ service, cache: cacheFor(service.key), ...rest }))\n  );\n}\n"]}

package/dist/{config-BEbP-uLf.d.cts → config-gro29syt.d.cts}

@@ -1,4 +1,4 @@
-import { l as SecretsInput, f as CheckContext, d as CheckReturn, h as CommonOptions } from './types-CctvUAs2.cjs';
+import { l as SecretsInput, f as CheckContext, d as CheckReturn, h as CommonOptions } from './types-BVa6vIKk.cjs';
 
 declare const DEFAULT_SLOW_MS = 2000;
 declare const DEFAULT_TIMEOUT_MS = 10000;

package/dist/{config-w1tm1bdu.d.ts → config-iY18j9IA.d.ts}

@@ -1,4 +1,4 @@
-import { l as SecretsInput, f as CheckContext, d as CheckReturn, h as CommonOptions } from './types-CctvUAs2.js';
+import { l as SecretsInput, f as CheckContext, d as CheckReturn, h as CommonOptions } from './types-BVa6vIKk.js';
 
 declare const DEFAULT_SLOW_MS = 2000;
 declare const DEFAULT_TIMEOUT_MS = 10000;

package/dist/{generic-lmrGxMDC.d.cts → generic-BUiaKpNp.d.cts}

@@ -1,5 +1,5 @@
-import { b as PresetOptions, S as ServiceDefinition } from './config-BEbP-uLf.cjs';
-import { l as SecretsInput, c as HttpResult, d as CheckReturn } from './types-CctvUAs2.cjs';
+import { b as PresetOptions, S as ServiceDefinition } from './config-gro29syt.cjs';
+import { l as SecretsInput, c as HttpResult, d as CheckReturn } from './types-BVa6vIKk.cjs';
 
 type GenericHttpOptions<Secrets extends SecretsInput = SecretsInput> = PresetOptions & {
     /** How to call it */

package/dist/{generic-BJmlgtUM.d.ts → generic-CV2O4aNH.d.ts}

@@ -1,5 +1,5 @@
-import { b as PresetOptions, S as ServiceDefinition } from './config-w1tm1bdu.js';
-import { l as SecretsInput, c as HttpResult, d as CheckReturn } from './types-CctvUAs2.js';
+import { b as PresetOptions, S as ServiceDefinition } from './config-iY18j9IA.js';
+import { l as SecretsInput, c as HttpResult, d as CheckReturn } from './types-BVa6vIKk.js';
 
 type GenericHttpOptions<Secrets extends SecretsInput = SecretsInput> = PresetOptions & {
     /** How to call it */

package/dist/index.cjs

@@ -2,7 +2,7 @@
 
 var chunkNP3YYVRZ_cjs = require('./chunk-NP3YYVRZ.cjs');
 var chunkELV4ZU6G_cjs = require('./chunk-ELV4ZU6G.cjs');
-var chunkPARE6EUZ_cjs = require('./chunk-PARE6EUZ.cjs');
+var chunkNZTKXXW2_cjs = require('./chunk-NZTKXXW2.cjs');
 var chunkXHXEKB3Q_cjs = require('./chunk-XHXEKB3Q.cjs');
 
 // src/stores/memory.ts
@@ -109,7 +109,7 @@ function defineStatus(config) {
   const scoring = chunkNP3YYVRZ_cjs.resolveScoring(config.scoring);
   const warn = config.onWarning ?? ((message) => console.warn(`[sermon-js] ${message}`));
   for (const warning of resolved.warnings) warn(warning);
-  const secretValues = chunkPARE6EUZ_cjs.collectSecretValues(
+  const secretValues = chunkNZTKXXW2_cjs.collectSecretValues(
     [...services.values()].flatMap((service) => [...Object.values(service.secrets), ...service.sensitive ?? []])
   );
   const fallback = memoryStore({ now });
@@ -174,7 +174,7 @@ function defineStatus(config) {
     retentionMs,
     scoring,
     warnings: resolved.warnings,
-    redact: (text) => chunkPARE6EUZ_cjs.redactText({ text, secretValues }),
+    redact: (text) => chunkNZTKXXW2_cjs.redactText({ text, secretValues }),
     has: (key) => services.has(key),
     lock,
     lastFullRun,
@@ -183,7 +183,7 @@ function defineStatus(config) {
       if (unknown.length) throw new Error(`sermon-js: unknown service key(s): ${unknown.join(", ")}`);
       const selected = keys ? keys.map((key) => services.get(key)) : [...services.values()];
       const full = !keys;
-      const results = await chunkPARE6EUZ_cjs.runServices({
+      const results = await chunkNZTKXXW2_cjs.runServices({
         services: selected,
         secretValues,
         cacheFor: checkCache,
@@ -358,11 +358,11 @@ Object.defineProperty(exports, "generic", {
 });
 Object.defineProperty(exports, "collectSecretValues", {
   enumerable: true,
-  get: function () { return chunkPARE6EUZ_cjs.collectSecretValues; }
+  get: function () { return chunkNZTKXXW2_cjs.collectSecretValues; }
 });
 Object.defineProperty(exports, "sanitizeError", {
   enumerable: true,
-  get: function () { return chunkPARE6EUZ_cjs.sanitizeError; }
+  get: function () { return chunkNZTKXXW2_cjs.sanitizeError; }
 });
 Object.defineProperty(exports, "DEFAULT_SLOW_MS", {
   enumerable: true,

package/dist/index.d.cts

@@ -1,11 +1,11 @@
-import { D as Duration, T as TickResult, S as Status, a as Scoring } from './status-DsWzgb9Q.cjs';
-export { b as DEFAULT_SCORING, R as RunReport, c as ScoringInput, d as ServiceHistory, e as StatusConfig, f as computeScore, g as defineStatus, l as labelForScore, t as toMs } from './status-DsWzgb9Q.cjs';
-export { C as CustomOptions, D as DEFAULT_SLOW_MS, a as DEFAULT_TIMEOUT_MS, G as GroupDefinition, P as PresetContext, b as PresetOptions, c as PresetSpec, R as ResolvedNode, d as ResolvedService, S as ServiceDefinition, e as ServiceNode, f as custom, g as definePreset, h as group } from './config-BEbP-uLf.cjs';
-export { G as GenericHttpOptions, g as generic } from './generic-lmrGxMDC.cjs';
-import { S as StatusStore, R as RunSummary, C as CheckSample } from './store-DybhDphS.cjs';
-export { L as LockResult, T as TimeRange } from './store-DybhDphS.cjs';
-import { H as HistoryRange, a as HistoryBar, S as ServiceStats, C as CheckOutcome, b as HttpInit, c as HttpResult, d as CheckReturn } from './types-CctvUAs2.cjs';
-export { e as CheckCache, f as CheckContext, g as CheckResult, h as CommonOptions, G as GroupSnapshot, i as HistoryPayload, I as Instance, j as InstanceStats, M as Metrics, O as OutcomeStatus, P as ProbeHelpers, k as ScoreLabel, l as SecretsInput, m as ServiceSnapshot, n as SnapshotNode, o as Status, p as StatusSnapshot, T as Trigger, U as Usage } from './types-CctvUAs2.cjs';
+import { D as Duration, T as TickResult, S as Status, a as Scoring } from './status-BExBb08T.cjs';
+export { b as DEFAULT_SCORING, R as RunReport, c as ScoringInput, d as ServiceHistory, e as StatusConfig, f as computeScore, g as defineStatus, l as labelForScore, t as toMs } from './status-BExBb08T.cjs';
+export { C as CustomOptions, D as DEFAULT_SLOW_MS, a as DEFAULT_TIMEOUT_MS, G as GroupDefinition, P as PresetContext, b as PresetOptions, c as PresetSpec, R as ResolvedNode, d as ResolvedService, S as ServiceDefinition, e as ServiceNode, f as custom, g as definePreset, h as group } from './config-gro29syt.cjs';
+export { G as GenericHttpOptions, g as generic } from './generic-BUiaKpNp.cjs';
+import { S as StatusStore, R as RunSummary, C as CheckSample } from './store-CAIB7Esp.cjs';
+export { L as LockResult, T as TimeRange } from './store-CAIB7Esp.cjs';
+import { H as HistoryRange, a as HistoryBar, S as ServiceStats, C as CheckOutcome, b as HttpInit, c as HttpResult, d as CheckReturn } from './types-BVa6vIKk.cjs';
+export { e as CheckCache, f as CheckContext, g as CheckResult, h as CommonOptions, G as GroupSnapshot, i as HistoryPayload, I as Instance, j as InstanceStats, M as Metrics, O as OutcomeStatus, P as ProbeHelpers, k as ScoreLabel, l as SecretsInput, m as ServiceSnapshot, n as SnapshotNode, o as Status, p as StatusSnapshot, T as Trigger, U as Usage } from './types-BVa6vIKk.cjs';
 
 type SchedulerOptions = {
     /** How often to call `tick()` (default: the status `interval`) */

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-import { D as Duration, T as TickResult, S as Status, a as Scoring } from './status-zd04ZQ98.js';
-export { b as DEFAULT_SCORING, R as RunReport, c as ScoringInput, d as ServiceHistory, e as StatusConfig, f as computeScore, g as defineStatus, l as labelForScore, t as toMs } from './status-zd04ZQ98.js';
-export { C as CustomOptions, D as DEFAULT_SLOW_MS, a as DEFAULT_TIMEOUT_MS, G as GroupDefinition, P as PresetContext, b as PresetOptions, c as PresetSpec, R as ResolvedNode, d as ResolvedService, S as ServiceDefinition, e as ServiceNode, f as custom, g as definePreset, h as group } from './config-w1tm1bdu.js';
-export { G as GenericHttpOptions, g as generic } from './generic-BJmlgtUM.js';
-import { S as StatusStore, R as RunSummary, C as CheckSample } from './store-_GuzSP0z.js';
-export { L as LockResult, T as TimeRange } from './store-_GuzSP0z.js';
-import { H as HistoryRange, a as HistoryBar, S as ServiceStats, C as CheckOutcome, b as HttpInit, c as HttpResult, d as CheckReturn } from './types-CctvUAs2.js';
-export { e as CheckCache, f as CheckContext, g as CheckResult, h as CommonOptions, G as GroupSnapshot, i as HistoryPayload, I as Instance, j as InstanceStats, M as Metrics, O as OutcomeStatus, P as ProbeHelpers, k as ScoreLabel, l as SecretsInput, m as ServiceSnapshot, n as SnapshotNode, o as Status, p as StatusSnapshot, T as Trigger, U as Usage } from './types-CctvUAs2.js';
+import { D as Duration, T as TickResult, S as Status, a as Scoring } from './status-DmRhwvVC.js';
+export { b as DEFAULT_SCORING, R as RunReport, c as ScoringInput, d as ServiceHistory, e as StatusConfig, f as computeScore, g as defineStatus, l as labelForScore, t as toMs } from './status-DmRhwvVC.js';
+export { C as CustomOptions, D as DEFAULT_SLOW_MS, a as DEFAULT_TIMEOUT_MS, G as GroupDefinition, P as PresetContext, b as PresetOptions, c as PresetSpec, R as ResolvedNode, d as ResolvedService, S as ServiceDefinition, e as ServiceNode, f as custom, g as definePreset, h as group } from './config-iY18j9IA.js';
+export { G as GenericHttpOptions, g as generic } from './generic-CV2O4aNH.js';
+import { S as StatusStore, R as RunSummary, C as CheckSample } from './store-BfKP7CjW.js';
+export { L as LockResult, T as TimeRange } from './store-BfKP7CjW.js';
+import { H as HistoryRange, a as HistoryBar, S as ServiceStats, C as CheckOutcome, b as HttpInit, c as HttpResult, d as CheckReturn } from './types-BVa6vIKk.js';
+export { e as CheckCache, f as CheckContext, g as CheckResult, h as CommonOptions, G as GroupSnapshot, i as HistoryPayload, I as Instance, j as InstanceStats, M as Metrics, O as OutcomeStatus, P as ProbeHelpers, k as ScoreLabel, l as SecretsInput, m as ServiceSnapshot, n as SnapshotNode, o as Status, p as StatusSnapshot, T as Trigger, U as Usage } from './types-BVa6vIKk.js';
 
 type SchedulerOptions = {
     /** How often to call `tick()` (default: the status `interval`) */

package/dist/index.js

@@ -1,8 +1,8 @@
 import { toMs, resolveScoring, RANGES, bucketRuns, computeServiceStats, computeScore } from './chunk-APC2HVSI.js';
 export { DEFAULT_SCORING, RANGES, bucketRuns, computeScore, computeServiceStats, labelForScore, toMs } from './chunk-APC2HVSI.js';
 export { generic } from './chunk-I3346MUL.js';
-import { collectSecretValues, runServices, redactText } from './chunk-2M4UBCDM.js';
-export { collectSecretValues, sanitizeError } from './chunk-2M4UBCDM.js';
+import { collectSecretValues, runServices, redactText } from './chunk-R7BDAQOM.js';
+export { collectSecretValues, sanitizeError } from './chunk-R7BDAQOM.js';
 import { resolveTree } from './chunk-XPXIDJUU.js';
 export { DEFAULT_SLOW_MS, DEFAULT_TIMEOUT_MS, combine, createHttp, custom, definePreset, errorMessage, group, measure } from './chunk-XPXIDJUU.js';