veryfront 0.1.636 → 0.1.637

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.636",
+    "version": "0.1.637",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "workspace": [

package/esm/src/errors/logging.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../../src/src/errors/logging.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAoBD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,cAAc,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CAiCN;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,cAAc,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CAMN"}
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../../src/src/errors/logging.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAoBD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,cAAc,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CAoCN;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,cAAc,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CAMN"}

package/esm/src/errors/logging.js

@@ -6,6 +6,7 @@
  */
 import { isProduction } from "../platform/environment.js";
 import { serverLogger } from "../utils/logger/logger.js";
+import { redactSensitive } from "../utils/logger/redact.js";
 function toContextRecord(value) {
     return value && typeof value === "object" && !Array.isArray(value)
         ? value
@@ -30,6 +31,9 @@ function mergeContext(errorContext, extraContext) {
  */
 export function logError(error, context) {
     const mergedContext = mergeContext(error.context, context);
+    // Redact once and reuse for both the production JSON entry and the dev-mode
+    // human-readable dump, so neither path can emit unredacted credentials.
+    const safeContext = redactSensitive(mergedContext);
     const entry = {
         level: "error",
         slug: error.slug,
@@ -40,7 +44,7 @@ export function logError(error, context) {
         status: error.status,
         docs: error.getDocsUrl(),
         timestamp: new Date().toISOString(),
-        context: mergedContext,
+        context: safeContext,
     };
     if (isProduction()) {
         // Direct JSON output — this module owns its own structured format
@@ -57,8 +61,8 @@ export function logError(error, context) {
             serverLogger.error(`  💡 Suggestion: ${error.suggestion}`);
         }
         serverLogger.error(`  📚 Docs: ${entry.docs}`);
-        if (mergedContext) {
-            serverLogger.error(`  Context: ${JSON.stringify(mergedContext, null, 2)}`);
+        if (safeContext) {
+            serverLogger.error(`  Context: ${JSON.stringify(safeContext, null, 2)}`);
         }
     }
 }

package/esm/src/oauth/index.d.ts

@@ -24,5 +24,6 @@ export type { AuthorizationUrlOptions, OAuthProviderConfig, OAuthServiceConfig,
 export { OAuthProvider, OAuthService } from "./providers/base.js";
 export { airtableConfig, asanaConfig, bitbucketConfig, boxConfig, calendarConfig, clickupConfig, confluenceConfig, driveConfig, figmaConfig, freshdeskConfig, githubConfig, gitlabConfig, gmailConfig, hubspotConfig, intercomConfig, jiraConfig, linearConfig, mailchimpConfig, mondayConfig, notionConfig, oneDriveConfig, outlookConfig, pipedriveConfig, quickbooksConfig, salesforceConfig, sharePointConfig, sheetsConfig, shopifyConfig, slackConfig, teamsConfig, trelloConfig, twitterConfig, webexConfig, xeroConfig, zoomConfig, } from "./providers/index.js";
 export { MemoryTokenStore } from "./token-store/index.js";
+export type { MemoryTokenStoreOptions } from "./token-store/index.js";
 export { createOAuthCallbackHandler, createOAuthDisconnectHandler, createOAuthInitHandler, createOAuthStatusHandler, type OAuthCallbackHandlerOptions, type OAuthInitHandlerOptions, } from "./handlers/index.js";
 //# sourceMappingURL=index.d.ts.map

package/esm/src/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,yBAAyB,CAAC;AAGjC,YAAY,EACV,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,UAAU,EACV,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,UAAU,GACX,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EACL,cAAc,EACd,WAAW,EACX,eAAe,EACf,SAAS,EACT,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,aAAa,EACb,cAAc,EACd,UAAU,EACV,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,WAAW,EACX,WAAW,EACX,YAAY,EACZ,aAAa,EACb,WAAW,EACX,UAAU,EACV,UAAU,GACX,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,sBAAsB,EACtB,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,yBAAyB,CAAC;AAGjC,YAAY,EACV,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,UAAU,EACV,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,UAAU,GACX,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EACL,cAAc,EACd,WAAW,EACX,eAAe,EACf,SAAS,EACT,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,aAAa,EACb,cAAc,EACd,UAAU,EACV,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,WAAW,EACX,WAAW,EACX,YAAY,EACZ,aAAa,EACb,WAAW,EACX,UAAU,EACV,UAAU,GACX,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEtE,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,sBAAsB,EACtB,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC"}

package/esm/src/oauth/token-store/index.d.ts

@@ -4,5 +4,6 @@
  * @module oauth/token-store
  */
 export { MemoryTokenStore, memoryTokenStore } from "./memory.js";
+export type { MemoryTokenStoreOptions } from "./memory.js";
 export type { OAuthState, OAuthTokens, StoredOAuthState, TokenStore } from "../types.js";
 //# sourceMappingURL=index.d.ts.map

package/esm/src/oauth/token-store/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/oauth/token-store/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/oauth/token-store/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjE,YAAY,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC3D,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC"}

package/esm/src/oauth/token-store/memory.d.ts

@@ -1,17 +1,39 @@
 import type { OAuthTokens, StoredOAuthState, TokenStore } from "../types.js";
+/** Options for {@link MemoryTokenStore}. */
+export interface MemoryTokenStoreOptions {
+    /**
+     * Maximum number of `(serviceId, userId)` token slots to retain before
+     * least-recently-used eviction kicks in. Defaults to
+     * {@link DEFAULT_MAX_TOKEN_ENTRIES}.
+     */
+    maxEntries?: number;
+}
 /**
  * In-memory TokenStore keyed by `(serviceId, userId)`.
  *
- * Suitable for development and tests. For production use a persistent store
- * (Redis, Postgres, ...) keyed the same way. Never share a single slot per
- * service across users — see VULN-AUTH-2.
+ * Suitable for development and tests ONLY. It is process-local and not
+ * durable: tokens are lost on restart and not shared across instances or
+ * workers, and the exported {@link memoryTokenStore} singleton shares one
+ * keyspace process-wide. For production inject a persistent, scoped store
+ * (Redis, Postgres, ...) keyed the same way.
+ *
+ * The token map is bounded (see {@link MemoryTokenStoreOptions.maxEntries}) so
+ * it cannot grow without limit. Never share a single slot per service across
+ * users — see VULN-AUTH-2.
  */
 export declare class MemoryTokenStore implements TokenStore {
     private tokens;
     private states;
     private projectId;
-    constructor(projectId?: string);
+    private warnedProductionUse;
+    constructor(projectId?: string, options?: MemoryTokenStoreOptions);
     private scopedKey;
+    /**
+     * Warn once if this non-durable store is used to persist tokens in
+     * production — almost always a misconfiguration (a persistent TokenStore
+     * should have been injected).
+     */
+    private warnIfProductionUse;
     getTokens(serviceId: string, userId: string): Promise<OAuthTokens | null>;
     setTokens(serviceId: string, userId: string, tokens: OAuthTokens): Promise<void>;
     clearTokens(serviceId: string, userId: string): Promise<void>;

package/esm/src/oauth/token-store/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../../src/src/oauth/token-store/memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAK7E;;;;;;GAMG;AACH,qBAAa,gBAAiB,YAAW,UAAU;IACjD,OAAO,CAAC,MAAM,CAAkC;IAChD,OAAO,CAAC,MAAM,CAAuC;IACrD,OAAO,CAAC,SAAS,CAAS;gBAEd,SAAS,SAAY;IAIjC,OAAO,CAAC,SAAS;IAIjB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAIzE,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhF,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAM9D;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAU7D,OAAO,CAAC,oBAAoB;IAS5B,iFAAiF;IACjF,oBAAoB,IAAI,MAAM,EAAE;IAOhC,4DAA4D;IAC5D,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAQvD,QAAQ,IAAI,IAAI;CAIjB;AAED,eAAO,MAAM,gBAAgB,EAAE,UAAmC,CAAC"}
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../../src/src/oauth/token-store/memory.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAgB7E,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,gBAAiB,YAAW,UAAU;IACjD,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,MAAM,CAAuC;IACrD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,mBAAmB,CAAS;gBAExB,SAAS,SAAY,EAAE,OAAO,GAAE,uBAA4B;IAOxE,OAAO,CAAC,SAAS;IAIjB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAW3B,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAMzE,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAMhF,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAM9D;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAU7D,OAAO,CAAC,oBAAoB;IAS5B,iFAAiF;IACjF,oBAAoB,IAAI,MAAM,EAAE;IAOhC,4DAA4D;IAC5D,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAQvD,QAAQ,IAAI,IAAI;CAIjB;AAED,eAAO,MAAM,gBAAgB,EAAE,UAAmC,CAAC"}

package/esm/src/oauth/token-store/memory.js

@@ -1,26 +1,63 @@
+import { logger as baseLogger } from "../../utils/index.js";
+import { isProduction } from "../../platform/environment.js";
+import { LRUCacheAdapter } from "../../utils/cache/stores/memory/lru-cache-adapter.js";
+const logger = baseLogger.component("o-auth");
 /** State expiry window: reject any state older than this (10 minutes). */
 const STATE_EXPIRY_MS = 10 * 60 * 1_000;
+/**
+ * Default cap on stored token slots. Bounds memory in long-lived processes;
+ * past this, the least-recently-used `(serviceId, userId)` slot is evicted
+ * (the affected user simply re-authenticates). Tokens are NOT given a TTL —
+ * an expired access token may still be refreshable via its refresh token, so
+ * eviction is by capacity/recency only.
+ */
+const DEFAULT_MAX_TOKEN_ENTRIES = 10_000;
 /**
  * In-memory TokenStore keyed by `(serviceId, userId)`.
  *
- * Suitable for development and tests. For production use a persistent store
- * (Redis, Postgres, ...) keyed the same way. Never share a single slot per
- * service across users — see VULN-AUTH-2.
+ * Suitable for development and tests ONLY. It is process-local and not
+ * durable: tokens are lost on restart and not shared across instances or
+ * workers, and the exported {@link memoryTokenStore} singleton shares one
+ * keyspace process-wide. For production inject a persistent, scoped store
+ * (Redis, Postgres, ...) keyed the same way.
+ *
+ * The token map is bounded (see {@link MemoryTokenStoreOptions.maxEntries}) so
+ * it cannot grow without limit. Never share a single slot per service across
+ * users — see VULN-AUTH-2.
  */
 export class MemoryTokenStore {
-    tokens = new Map();
+    tokens;
     states = new Map();
     projectId;
-    constructor(projectId = "default") {
+    warnedProductionUse = false;
+    constructor(projectId = "default", options = {}) {
         this.projectId = projectId;
+        this.tokens = new LRUCacheAdapter({
+            maxEntries: options.maxEntries ?? DEFAULT_MAX_TOKEN_ENTRIES,
+        });
     }
     scopedKey(serviceId, userId) {
         return `${this.projectId}:${serviceId}:${userId}`;
     }
+    /**
+     * Warn once if this non-durable store is used to persist tokens in
+     * production — almost always a misconfiguration (a persistent TokenStore
+     * should have been injected).
+     */
+    warnIfProductionUse() {
+        if (this.warnedProductionUse || !isProduction())
+            return;
+        this.warnedProductionUse = true;
+        logger.warn("MemoryTokenStore is persisting OAuth tokens in production. It is " +
+            "process-local and not durable (tokens are lost on restart and not " +
+            "shared across instances). Inject a persistent, scoped TokenStore " +
+            "(Redis/Postgres/...) instead.");
+    }
     getTokens(serviceId, userId) {
         return Promise.resolve(this.tokens.get(this.scopedKey(serviceId, userId)) ?? null);
     }
     setTokens(serviceId, userId, tokens) {
+        this.warnIfProductionUse();
         this.tokens.set(this.scopedKey(serviceId, userId), tokens);
         return Promise.resolve();
     }

package/esm/src/observability/log-buffer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"log-buffer.d.ts","sourceRoot":"","sources":["../../../src/src/observability/log-buffer.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3D,2BAA2B;AAC3B,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,uDAAuD;AACvD,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,EAAE,QAAQ,GAAG,QAAQ,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;AAEtD,4BAA4B;AAC5B,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO;IAI9C,OAAO,CAAC,UAAU;IAIlB,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,WAAW,CAAC,GAAG,QAAQ;IAwB3D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ;IAInF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ;IAIlF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ;IAIlF,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ;IAInF,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,QAAQ,EAAE;IAqCrC,IAAI,CAAC,KAAK,SAAK,GAAG,QAAQ,EAAE;IAI5B,MAAM,IAAI,QAAQ,EAAE;IAIpB,KAAK,IAAI,IAAI;IAIb,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC;IAUxC,SAAS,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,IAAI;IAK9C,MAAM,IAAI,QAAQ,EAAE;IAIpB,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,GAAG,MAAM;CAYrC;AAID,yBAAyB;AACzB,wBAAgB,YAAY,IAAI,SAAS,CAGxC;AAED,sCAAsC;AACtC,wBAAgB,cAAc,IAAI,IAAI,CAGrC;AAED,gDAAgD;AAChD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,SAAY,GAAG,MAAM,IAAI,CA2ClF"}
+{"version":3,"file":"log-buffer.d.ts","sourceRoot":"","sources":["../../../src/src/observability/log-buffer.ts"],"names":[],"mappings":"AAEA,yCAAyC;AACzC,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3D,2BAA2B;AAC3B,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,uDAAuD;AACvD,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,EAAE,QAAQ,GAAG,QAAQ,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;AAEtD,4BAA4B;AAC5B,qBAAa,SAAS;IACpB,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO;IAI9C,OAAO,CAAC,UAAU;IAIlB,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,WAAW,CAAC,GAAG,QAAQ;IA2B3D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ;IAInF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ;IAIlF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ;IAIlF,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ;IAInF,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,QAAQ,EAAE;IAqCrC,IAAI,CAAC,KAAK,SAAK,GAAG,QAAQ,EAAE;IAI5B,MAAM,IAAI,QAAQ,EAAE;IAIpB,KAAK,IAAI,IAAI;IAIb,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC;IAUxC,SAAS,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,IAAI;IAK9C,MAAM,IAAI,QAAQ,EAAE;IAIpB,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,GAAG,MAAM;CAYrC;AAID,yBAAyB;AACzB,wBAAgB,YAAY,IAAI,SAAS,CAGxC;AAED,sCAAsC;AACtC,wBAAgB,cAAc,IAAI,IAAI,CAGrC;AAED,gDAAgD;AAChD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,SAAY,GAAG,MAAM,IAAI,CA6ClF"}

package/esm/src/observability/log-buffer.js

@@ -1,3 +1,4 @@
+import { redactSensitive } from "../utils/logger/redact.js";
 /** Implement log buffer. */
 export class LogBuffer {
     entries = [];
@@ -13,6 +14,9 @@ export class LogBuffer {
     append(entry) {
         const fullEntry = {
             ...entry,
+            // Redact credential-like keys before the entry is buffered, surfaced to
+            // subscribers, or written to disk by the file subscriber (#1989).
+            data: entry.data ? redactSensitive(entry.data) : entry.data,
             id: this.generateId(),
             timestamp: Date.now(),
         };
@@ -136,7 +140,9 @@ export function interceptConsole(buffer, source = "console") {
             if (typeof a === "string")
                 return a;
             try {
-                return JSON.stringify(a);
+                // Redact object args before they are folded into the message string,
+                // where the per-entry data redaction can no longer reach them (#1989).
+                return JSON.stringify(redactSensitive(a));
             }
             catch (_) {
                 /* expected: circular references or non-serializable values */

package/esm/src/platform/adapters/redis/modules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../../../../../src/src/platform/adapters/redis/modules.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAKnE,wBAAgB,cAAc,IAAI,OAAO,CAAC;IACxC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAClC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;CACnC,CAAC,CAqCD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAGvC"}
+{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../../../../../src/src/platform/adapters/redis/modules.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAKnE,wBAAgB,cAAc,IAAI,OAAO,CAAC;IACxC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAClC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;CACnC,CAAC,CA6BD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAGvC"}

package/esm/src/platform/adapters/redis/modules.js

@@ -10,9 +10,7 @@ export function getRedisModule() {
     return withSpan("platform.redis.getModule", async () => {
         try {
             if (isDeno) {
-                const denoRedisUrl = "https://deno.land/x/redis@v0.32.1/mod.ts";
-                // @ts-ignore - Deno global
-                DenoRedis = await import(denoRedisUrl);
+                NodeRedis = (await import("redis"));
             }
             else {
                 NodeRedis = (await import("redis"));
@@ -20,14 +18,9 @@ export function getRedisModule() {
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            if (isDeno) {
-                throw INITIALIZATION_ERROR.create({
-                    detail: `Failed to load Deno Redis module. Error: ${message}`,
-                    cause: error instanceof Error ? error : undefined,
-                });
-            }
+            const packageName = isDeno ? "npm:redis@5.11.0" : "redis";
             throw INITIALIZATION_ERROR.create({
-                detail: `Failed to load 'redis' package. Please install it with: npm install redis\nError: ${message}`,
+                detail: `Failed to load '${packageName}' package. Please install it with: npm install redis\nError: ${message}`,
                 cause: error instanceof Error ? error : undefined,
             });
         }

package/esm/src/utils/logger/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../../src/src/utils/logger/logger.ts"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,YAAY,EAEjB,KAAK,eAAe,EAErB,MAAM,WAAW,CAAC;AAEnB,oBAAY,QAAQ;IAClB,KAAK,IAAI;IACT,IAAI,IAAI;IACR,IAAI,IAAI;IACR,KAAK,IAAI;CACV;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAExC;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAEhB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAElC,KAAK,CAAC,EAAE,eAAe,CAAC;IAExB,kJAAkJ;IAClJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gJAAgJ;IAChJ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+IAA+I;IAC/I,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oJAAoJ;IACpJ,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,mJAAmJ;IACnJ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,sCAAsC;AACtC,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChD,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjD,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzD;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC;IAChD;;;;OAIG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC;AAOD,KAAK,oBAAoB,GAAG;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAgBF;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,GAAE,MAAM,GAAG,SAA+B,EAClD,SAAS,GAAE,MAAM,GAAG,SAAqC,GACxD,QAAQ,CAKV;AA2BD;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAK1C;AAED,sCAAsC;AACtC,eAAO,MAAM,2BAA2B,4BAAsB,CAAC;AAiF/D,cAAM,aAAc,YAAW,MAAM;IAKjC,OAAO,CAAC,MAAM;IAGd,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,aAAa,CAAC,CAAS;gBAGrB,MAAM,EAAE,MAAM,EACtB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtC,aAAa,CAAC,EAAE,MAAM,EACL,OAAO,GAAE,oBAAyB;IAMrD,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;IAS/C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAI/B,OAAO,CAAC,UAAU;IAwElB,OAAO,CAAC,cAAc;IAgBtB,OAAO,CAAC,GAAG;IAiBX,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI;IAIhD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI;IAI/C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI;IAI/C,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI;IAI1C,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAa/D;AA+BD;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GAC3C,IAAI,CAEN;AASD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAClD,IAAI,CAEN;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,IAAI,IAAI,CAExD;AAsED,eAAO,MAAM,SAAS,QAA0C,CAAC;AACjE,kCAAkC;AAClC,eAAO,MAAM,YAAY,QAA6C,CAAC;AACvE,oCAAoC;AACpC,eAAO,MAAM,cAAc,QAA+C,CAAC;AAC3E,mCAAmC;AACnC,eAAO,MAAM,aAAa,QAA8C,CAAC;AACzE,iCAAiC;AACjC,eAAO,MAAM,WAAW,QAA4C,CAAC;AACrE,eAAO,MAAM,WAAW,QAA4C,CAAC;AACrE,2BAA2B;AAC3B,eAAO,MAAM,MAAM,QAAuC,CAAC;AAE3D;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,oBAAoB,GAC7B,aAAa,CASf;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACA,MAAM,CAER;AAED,8BAA8B;AAC9B,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE;IACV,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,MAAM,CAUR"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../../src/src/utils/logger/logger.ts"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,YAAY,EAEjB,KAAK,eAAe,EAErB,MAAM,WAAW,CAAC;AAGnB,oBAAY,QAAQ;IAClB,KAAK,IAAI;IACT,IAAI,IAAI;IACR,IAAI,IAAI;IACR,KAAK,IAAI;CACV;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;AAExC;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAEhB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAElC,KAAK,CAAC,EAAE,eAAe,CAAC;IAExB,kJAAkJ;IAClJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gJAAgJ;IAChJ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+IAA+I;IAC/I,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oJAAoJ;IACpJ,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,mJAAmJ;IACnJ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,sCAAsC;AACtC,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChD,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACjD,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzD;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC;IAChD;;;;OAIG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC;AAOD,KAAK,oBAAoB,GAAG;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAgBF;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,GAAE,MAAM,GAAG,SAA+B,EAClD,SAAS,GAAE,MAAM,GAAG,SAAqC,GACxD,QAAQ,CAKV;AA2BD;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAK1C;AAED,sCAAsC;AACtC,eAAO,MAAM,2BAA2B,4BAAsB,CAAC;AAiF/D,cAAM,aAAc,YAAW,MAAM;IAKjC,OAAO,CAAC,MAAM;IAGd,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,aAAa,CAAC,CAAS;gBAGrB,MAAM,EAAE,MAAM,EACtB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtC,aAAa,CAAC,EAAE,MAAM,EACL,OAAO,GAAE,oBAAyB;IAMrD,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;IAS/C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAI/B,OAAO,CAAC,UAAU;IAsFlB,OAAO,CAAC,cAAc;IAoBtB,OAAO,CAAC,GAAG;IAiBX,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI;IAIhD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI;IAI/C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI;IAI/C,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI;IAI1C,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAa/D;AA+BD;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GAC3C,IAAI,CAEN;AASD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAClD,IAAI,CAEN;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,IAAI,IAAI,CAExD;AAsED,eAAO,MAAM,SAAS,QAA0C,CAAC;AACjE,kCAAkC;AAClC,eAAO,MAAM,YAAY,QAA6C,CAAC;AACvE,oCAAoC;AACpC,eAAO,MAAM,cAAc,QAA+C,CAAC;AAC3E,mCAAmC;AACnC,eAAO,MAAM,aAAa,QAA8C,CAAC;AACzE,iCAAiC;AACjC,eAAO,MAAM,WAAW,QAA4C,CAAC;AACrE,eAAO,MAAM,WAAW,QAA4C,CAAC;AACrE,2BAA2B;AAC3B,eAAO,MAAM,MAAM,QAAuC,CAAC;AAE3D;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,oBAAoB,GAC7B,aAAa,CASf;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACA,MAAM,CAER;AAED,8BAA8B;AAC9B,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE;IACV,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,MAAM,CAUR"}

package/esm/src/utils/logger/logger.js

@@ -1,6 +1,7 @@
 import { getEnv, isStdoutTTY } from "../../platform/compat/process.js";
 import { RUNTIME_VERSION } from "../version.js";
 import { ANSI, colorize, formatContextText, formatTimestamp, LEVEL_COLORS, LEVEL_GLYPHS, padTag, serializeError, } from "./core.js";
+import { redactSensitive, sanitizeSerializedError, sanitizeUrlCredentials } from "./redact.js";
 export var LogLevel;
 (function (LogLevel) {
     LogLevel[LogLevel["DEBUG"] = 0] = "DEBUG";
@@ -181,8 +182,11 @@ class ConsoleLogger {
         extractToEntryField(entry, mergedContext, "trace_id", (v) => String(v));
         extractToEntryField(entry, mergedContext, "span_id", (v) => String(v));
         extractToEntryField(entry, mergedContext, "project_slug", (v) => String(v));
-        extractToEntryField(entry, mergedContext, "request_url", (v) => String(v));
-        extractToEntryField(entry, mergedContext, "domain", (v) => String(v));
+        // request_url / domain are URL-shaped and lifted out of mergedContext
+        // *before* redactSensitive runs, so they bypass the key-based redactor.
+        // Scrub embedded credentials (userinfo, ?access_token=, …) here (#1989).
+        extractToEntryField(entry, mergedContext, "request_url", (v) => sanitizeUrlCredentials(String(v)));
+        extractToEntryField(entry, mergedContext, "domain", (v) => sanitizeUrlCredentials(String(v)));
         extractToEntryField(entry, mergedContext, "project_id", (v) => String(v));
         extractToEntryField(entry, mergedContext, "release_id", (v) => String(v));
         extractToEntryField(entry, mergedContext, "branch_id", (v) => String(v));
@@ -215,10 +219,16 @@ class ConsoleLogger {
         if (entry.conversationId && !entry.conversation_id) {
             entry.conversation_id = entry.conversationId;
         }
+        // Redact credential-like keys from the free-form context bag before
+        // serialization (the deliberate top-level fields above are already
+        // extracted out of mergedContext, so they are unaffected).
         if (Object.keys(mergedContext).length > 0)
-            entry.context = mergedContext;
+            entry.context = redactSensitive(mergedContext);
+        // The serialized error (name/message/stack) bypasses the key-based
+        // redactor; scrub credentials embedded in its message/stack (DSNs, Mongo
+        // URIs, ?access_token= URLs, userinfo) before emission (#1989).
         if (error)
-            entry.error = error;
+            entry.error = sanitizeSerializedError(error);
         return JSON.stringify(entry);
     }
     formatTextLine(level, message, args) {
@@ -231,7 +241,7 @@ class ConsoleLogger {
         const componentTag = this.componentName
             ? ` ${colorize(`[${this.componentName}]`, ANSI.dim, enableColor)}`
             : "";
-        const contextText = formatContextText(mergedContext, error, enableColor);
+        const contextText = formatContextText(redactSensitive(mergedContext), sanitizeSerializedError(error), enableColor);
         return `${timestamp}  ${tag} ${glyph}${componentTag} ${message}${contextText}`;
     }
     log(level, logLevel, consoleFn, message, args) {

package/esm/src/utils/logger/redact.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Secret / credential redaction for structured log context.
+ *
+ * Defense-in-depth (#1989): the logger, the error-logging path, and the
+ * observability log buffer all accept arbitrary `context`/`data` objects from
+ * callers and serialize them to log sinks. There is no guarantee a caller
+ * never hands us a tokens object, an `Authorization` header bag, or a request
+ * body with a password field. This pass masks values whose *key* looks like a
+ * credential before serialization, so an accidental
+ * `logger.info("...", { authorization: token })` cannot leak the secret.
+ *
+ * Scope is intentionally key-based: we do not attempt to find secrets embedded
+ * in free-form message strings (too lossy). The deny-list errs toward
+ * over-redaction — masking a benign `tokenCount` is acceptable; leaking a real
+ * token is not. The traversal fails *closed*: on a cycle, depth overflow, or a
+ * throwing getter it returns {@link REDACTED} rather than risk emitting an
+ * unredacted object.
+ */
+/** Replacement value substituted for any sensitive field. */
+export declare const REDACTED = "[REDACTED]";
+/**
+ * Whether a context key names a credential and should have its value masked.
+ *
+ * Uses substring matching on a normalized key, so `clientSecret`,
+ * `x-api-key`, and `refresh_token` all match while benign words that merely
+ * *contain* a pattern as a separate token (e.g. `author`) do not — `author`
+ * normalizes to `author`, which contains none of the patterns.
+ */
+export declare function isSensitiveKey(key: string): boolean;
+/**
+ * Returns a redacted deep copy of `context`. Any property whose key is
+ * {@link isSensitiveKey} has its value replaced with {@link REDACTED}; nested
+ * plain objects, class instances, and arrays are traversed. The input is never
+ * mutated, and the pass fails closed (returns {@link REDACTED}) on cycles,
+ * depth overflow, or a throwing getter.
+ */
+export declare function redactSensitive<T>(context: T): T;
+/**
+ * Strip credentials from URL-shaped strings so they can be safely emitted in
+ * free-form text (error messages, stacks, lifted `request_url` fields). Unlike
+ * {@link redactSensitive}, which is key-based, this scrubs secrets embedded in
+ * the *value* itself:
+ *
+ * - URL userinfo: `http://user:pass@host` → `http://user:[REDACTED]@host`
+ * - sensitive query params: `?access_token=abc` → `?access_token=[REDACTED]`
+ *
+ * It is intentionally tolerant: it operates on any string (a DSN, a Mongo URI,
+ * an axios error message containing a URL) via regex rather than requiring a
+ * parseable URL, so malformed or partial URLs in error text are still scrubbed.
+ * Non-URL strings pass through unchanged.
+ */
+export declare function sanitizeUrlCredentials(input: string): string;
+/**
+ * Apply {@link sanitizeUrlCredentials} to the `message` and `stack` of a
+ * serialized-error-shaped object, returning a new object. Used by the logger's
+ * JSON and text paths so errors carrying DSNs, Mongo URIs, or
+ * `?access_token=`-bearing URLs do not leak credentials (the serialized error
+ * bypasses the key-based redactor). Returns the input unchanged when falsy.
+ */
+export declare function sanitizeSerializedError<T extends {
+    message?: unknown;
+    stack?: unknown;
+} | undefined>(error: T): T;
+//# sourceMappingURL=redact.d.ts.map

package/esm/src/utils/logger/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../../../src/src/utils/logger/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,6DAA6D;AAC7D,eAAO,MAAM,QAAQ,eAAe,CAAC;AA2CrC;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGnD;AA6ED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAEhD;AA2BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA4B5D;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,CAAC,SAAS;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,EAC5D,KAAK,EAAE,CAAC,GAAG,CAAC,CAMb"}

package/esm/src/utils/logger/redact.js

@@ -0,0 +1,235 @@
+/**
+ * Secret / credential redaction for structured log context.
+ *
+ * Defense-in-depth (#1989): the logger, the error-logging path, and the
+ * observability log buffer all accept arbitrary `context`/`data` objects from
+ * callers and serialize them to log sinks. There is no guarantee a caller
+ * never hands us a tokens object, an `Authorization` header bag, or a request
+ * body with a password field. This pass masks values whose *key* looks like a
+ * credential before serialization, so an accidental
+ * `logger.info("...", { authorization: token })` cannot leak the secret.
+ *
+ * Scope is intentionally key-based: we do not attempt to find secrets embedded
+ * in free-form message strings (too lossy). The deny-list errs toward
+ * over-redaction — masking a benign `tokenCount` is acceptable; leaking a real
+ * token is not. The traversal fails *closed*: on a cycle, depth overflow, or a
+ * throwing getter it returns {@link REDACTED} rather than risk emitting an
+ * unredacted object.
+ */
+import { isRecord } from "./core.js";
+/** Replacement value substituted for any sensitive field. */
+export const REDACTED = "[REDACTED]";
+/**
+ * Normalized substrings that mark a key as sensitive. Matching is done against
+ * a lowercased, non-alphanumeric-stripped form of the key, so `API-Key`,
+ * `api_key`, and `apiKey` all collapse to `apikey` and match.
+ *
+ * Deliberately omitted to avoid false positives that swamp real logs:
+ * - bare `"auth"` (would mask `author`); `authorization`/`authToken` are still
+ *   covered via `authorization`/`token`.
+ * - short tokens like `"dsn"`/`"sas"` (would mask `feedsNamespace`, etc.).
+ */
+const SENSITIVE_KEY_PATTERNS = [
+    "password",
+    "passwd",
+    "pwd",
+    "passphrase",
+    "secret",
+    "clientsecret",
+    "token",
+    "apikey",
+    "accesskey",
+    "privatekey",
+    "credential",
+    "authorization",
+    "cookie",
+    "bearer",
+    "jwt",
+    "connectionstring",
+    "signature",
+    "sessionid",
+    "sid",
+    "otp",
+    "mfa",
+    "pin",
+    "salt",
+    "xsrf",
+    "csrf",
+];
+/** Stop traversing past this depth to keep the pass cheap and stack-safe. */
+const MAX_DEPTH = 16;
+/**
+ * Whether a context key names a credential and should have its value masked.
+ *
+ * Uses substring matching on a normalized key, so `clientSecret`,
+ * `x-api-key`, and `refresh_token` all match while benign words that merely
+ * *contain* a pattern as a separate token (e.g. `author`) do not — `author`
+ * normalizes to `author`, which contains none of the patterns.
+ */
+export function isSensitiveKey(key) {
+    const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+    return SENSITIVE_KEY_PATTERNS.some((pattern) => normalized.includes(pattern));
+}
+/**
+ * A non-null, non-array object. {@link isRecord} covers class instances too,
+ * whose enumerable fields `JSON.stringify` *would* serialize, so we must
+ * traverse them to catch secrets.
+ */
+function isTraversableRecord(value) {
+    return isRecord(value);
+}
+function hasToJson(value) {
+    return typeof value.toJSON === "function";
+}
+function redactValue(value, depth, seen) {
+    if (Array.isArray(value)) {
+        if (depth >= MAX_DEPTH || seen.has(value))
+            return REDACTED;
+        seen.add(value);
+        try {
+            return value.map((item) => redactValue(item, depth + 1, seen));
+        }
+        finally {
+            seen.delete(value);
+        }
+    }
+    // Objects defining `toJSON` (Date, URL, custom serializers) are serialized
+    // by `JSON.stringify` via the *return value* of `toJSON`, not their own
+    // enumerable keys. A key-based pass over the object's own properties would
+    // therefore miss credentials smuggled through `toJSON`, e.g.
+    // `{ toJSON: () => ({ apiKey: "sk-..." }) }` (CODEX P2). When `toJSON`
+    // returns a non-scalar (an object/array that could carry credential keys),
+    // redact *that* — the thing actually emitted. When it returns a scalar
+    // (Date/URL → ISO string), the original object is left intact, preserving
+    // prior behavior and identity.
+    if (isRecord(value) && hasToJson(value)) {
+        if (depth >= MAX_DEPTH || seen.has(value))
+            return REDACTED;
+        seen.add(value);
+        try {
+            const serialized = value.toJSON();
+            if (isRecord(serialized) || Array.isArray(serialized)) {
+                return redactValue(serialized, depth + 1, seen);
+            }
+            // Scalar result (string/number/…): the object serializes safely as-is.
+            return value;
+        }
+        catch {
+            // A throwing toJSON must never let the raw object (whose own keys we
+            // skipped) through: fail closed.
+            return REDACTED;
+        }
+        finally {
+            seen.delete(value);
+        }
+    }
+    if (isTraversableRecord(value)) {
+        if (depth >= MAX_DEPTH || seen.has(value))
+            return REDACTED;
+        seen.add(value);
+        try {
+            const out = {};
+            for (const [key, child] of Object.entries(value)) {
+                out[key] = isSensitiveKey(key) ? REDACTED : redactValue(child, depth + 1, seen);
+            }
+            return out;
+        }
+        catch {
+            // A throwing getter (or other access error) must never let an
+            // unredacted object through: fail closed.
+            return REDACTED;
+        }
+        finally {
+            seen.delete(value);
+        }
+    }
+    // Primitives and scalar-serializing objects (Date, URL, …) are returned
+    // untouched: they are not key/value bags we can safely rewrite.
+    return value;
+}
+/**
+ * Returns a redacted deep copy of `context`. Any property whose key is
+ * {@link isSensitiveKey} has its value replaced with {@link REDACTED}; nested
+ * plain objects, class instances, and arrays are traversed. The input is never
+ * mutated, and the pass fails closed (returns {@link REDACTED}) on cycles,
+ * depth overflow, or a throwing getter.
+ */
+export function redactSensitive(context) {
+    return redactValue(context, 0, new Set());
+}
+/**
+ * Query-string parameter names that commonly carry credentials in URLs.
+ * Matched case-insensitively against the parameter name.
+ */
+const SENSITIVE_URL_PARAMS = [
+    "access_token",
+    "accesstoken",
+    "refresh_token",
+    "api_key",
+    "apikey",
+    "code",
+    "token",
+    "secret",
+    "client_secret",
+    "password",
+    "passwd",
+    "pwd",
+    "state",
+    "sig",
+    "signature",
+    "auth",
+];
+const URL_USERINFO_RE = /(\b[a-z][a-z0-9+.-]*:\/\/)([^/?#@\s]+)@/gi;
+/**
+ * Strip credentials from URL-shaped strings so they can be safely emitted in
+ * free-form text (error messages, stacks, lifted `request_url` fields). Unlike
+ * {@link redactSensitive}, which is key-based, this scrubs secrets embedded in
+ * the *value* itself:
+ *
+ * - URL userinfo: `http://user:pass@host` → `http://user:[REDACTED]@host`
+ * - sensitive query params: `?access_token=abc` → `?access_token=[REDACTED]`
+ *
+ * It is intentionally tolerant: it operates on any string (a DSN, a Mongo URI,
+ * an axios error message containing a URL) via regex rather than requiring a
+ * parseable URL, so malformed or partial URLs in error text are still scrubbed.
+ * Non-URL strings pass through unchanged.
+ */
+export function sanitizeUrlCredentials(input) {
+    if (typeof input !== "string" || input.length === 0)
+        return input;
+    // 1) userinfo: scheme://user:pass@  → mask the password (and any bare creds).
+    let out = input.replace(URL_USERINFO_RE, (_match, scheme, userinfo) => {
+        const colon = userinfo.indexOf(":");
+        if (colon === -1) {
+            // `scheme://token@host` — the whole userinfo is credential-like.
+            return `${scheme}${REDACTED}@`;
+        }
+        const user = userinfo.slice(0, colon);
+        return `${scheme}${user}:${REDACTED}@`;
+    });
+    // 2) sensitive query/fragment params: `key=value` → `key=[REDACTED]`.
+    // Match `?key=`, `&key=`, `;key=` separators and stop at the next delimiter.
+    out = out.replace(/([?&;])([a-z0-9_.\-]+)=([^&#;\s]*)/gi, (match, sep, key, _val) => {
+        const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+        const sensitive = SENSITIVE_URL_PARAMS.some((p) => normalized === p.replace(/[^a-z0-9]/g, ""));
+        return sensitive ? `${sep}${key}=${REDACTED}` : match;
+    });
+    return out;
+}
+/**
+ * Apply {@link sanitizeUrlCredentials} to the `message` and `stack` of a
+ * serialized-error-shaped object, returning a new object. Used by the logger's
+ * JSON and text paths so errors carrying DSNs, Mongo URIs, or
+ * `?access_token=`-bearing URLs do not leak credentials (the serialized error
+ * bypasses the key-based redactor). Returns the input unchanged when falsy.
+ */
+export function sanitizeSerializedError(error) {
+    if (!error)
+        return error;
+    const out = { ...error };
+    if (typeof out.message === "string")
+        out.message = sanitizeUrlCredentials(out.message);
+    if (typeof out.stack === "string")
+        out.stack = sanitizeUrlCredentials(out.stack);
+    return out;
+}

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.636";
+export declare const VERSION = "0.1.637";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.636";
+export const VERSION = "0.1.637";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.636",
+  "version": "0.1.637",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",
@@ -358,6 +358,7 @@
     "mdast-util-to-string": "4.0.0",
     "react": "19.2.4",
     "react-dom": "19.2.4",
+    "redis": "5.11.0",
     "rehype-highlight": "7.0.2",
     "rehype-raw": "7.0.0",
     "rehype-sanitize": "6.0.0",