First commit

node_modules/@pinojs/redact/test/actual-redact-comparison.test.js

@@ -0,0 +1,211 @@
+'use strict'
+
+// Node.js test comparing @pinojs/redact vs fast-redact for multiple wildcard patterns
+// This test validates that @pinojs/redact correctly handles 3+ consecutive wildcards
+// matching the behavior of fast-redact
+
+const { test } = require('node:test')
+const { strict: assert } = require('node:assert')
+const fastRedact = require('fast-redact')
+const slowRedact = require('../index.js')
+
+// Helper function to test redaction and track which values were censored
+function testRedactDirect (library, pattern, testData = {}) {
+  const matches = []
+  const redactor = library === '@pinojs/redact' ? slowRedact : fastRedact
+
+  try {
+    const redact = redactor({
+      paths: [pattern],
+      censor: (value, path) => {
+        if (
+          value !== undefined &&
+          value !== null &&
+          typeof value === 'string' &&
+          value.includes('secret')
+        ) {
+          matches.push({
+            value,
+            path: path ? path.join('.') : 'unknown'
+          })
+        }
+        return '[REDACTED]'
+      }
+    })
+
+    redact(JSON.parse(JSON.stringify(testData)))
+
+    return {
+      library,
+      pattern,
+      matches,
+      success: true,
+      testData
+    }
+  } catch (error) {
+    return {
+      library,
+      pattern,
+      matches: [],
+      success: false,
+      error: error.message,
+      testData
+    }
+  }
+}
+
+function testSlowRedactDirect (pattern, testData) {
+  return testRedactDirect('@pinojs/redact', pattern, testData)
+}
+
+function testFastRedactDirect (pattern, testData) {
+  return testRedactDirect('fast-redact', pattern, testData)
+}
+
+test('@pinojs/redact: *.password (2 levels)', () => {
+  const result = testSlowRedactDirect('*.password', {
+    simple: { password: 'secret-2-levels' }
+  })
+
+  assert.strictEqual(result.success, true)
+  assert.strictEqual(result.matches.length, 1)
+  assert.strictEqual(result.matches[0].value, 'secret-2-levels')
+})
+
+test('@pinojs/redact: *.*.password (3 levels)', () => {
+  const result = testSlowRedactDirect('*.*.password', {
+    simple: { password: 'secret-2-levels' },
+    user: { auth: { password: 'secret-3-levels' } }
+  })
+
+  assert.strictEqual(result.success, true)
+  assert.strictEqual(result.matches.length, 1)
+  assert.strictEqual(result.matches[0].value, 'secret-3-levels')
+})
+
+test('@pinojs/redact: *.*.*.password (4 levels)', () => {
+  const result = testSlowRedactDirect('*.*.*.password', {
+    simple: { password: 'secret-2-levels' },
+    user: { auth: { password: 'secret-3-levels' } },
+    nested: { deep: { auth: { password: 'secret-4-levels' } } }
+  })
+
+  assert.strictEqual(result.success, true)
+  assert.strictEqual(result.matches.length, 1)
+  assert.strictEqual(result.matches[0].value, 'secret-4-levels')
+})
+
+test('@pinojs/redact: *.*.*.*.password (5 levels)', () => {
+  const result = testSlowRedactDirect('*.*.*.*.password', {
+    simple: { password: 'secret-2-levels' },
+    user: { auth: { password: 'secret-3-levels' } },
+    nested: { deep: { auth: { password: 'secret-4-levels' } } },
+    config: {
+      user: { auth: { settings: { password: 'secret-5-levels' } } }
+    }
+  })
+
+  assert.strictEqual(result.success, true)
+  assert.strictEqual(result.matches.length, 1)
+  assert.strictEqual(result.matches[0].value, 'secret-5-levels')
+})
+
+test('@pinojs/redact: *.*.*.*.*.password (6 levels)', () => {
+  const result = testSlowRedactDirect('*.*.*.*.*.password', {
+    simple: { password: 'secret-2-levels' },
+    user: { auth: { password: 'secret-3-levels' } },
+    nested: { deep: { auth: { password: 'secret-4-levels' } } },
+    config: {
+      user: { auth: { settings: { password: 'secret-5-levels' } } }
+    },
+    data: {
+      reqConfig: {
+        data: {
+          credentials: {
+            settings: {
+              password: 'real-secret-6-levels'
+            }
+          }
+        }
+      }
+    }
+  })
+
+  assert.strictEqual(result.success, true)
+  assert.strictEqual(result.matches.length, 1)
+  assert.strictEqual(result.matches[0].value, 'real-secret-6-levels')
+})
+
+test('fast-redact: *.password (2 levels)', () => {
+  const result = testFastRedactDirect('*.password', {
+    simple: { password: 'secret-2-levels' }
+  })
+
+  assert.strictEqual(result.success, true)
+  assert.strictEqual(result.matches.length, 1)
+  assert.strictEqual(result.matches[0].value, 'secret-2-levels')
+})
+
+test('fast-redact: *.*.password (3 levels)', () => {
+  const result = testFastRedactDirect('*.*.password', {
+    simple: { password: 'secret-2-levels' },
+    user: { auth: { password: 'secret-3-levels' } }
+  })
+
+  assert.strictEqual(result.success, true)
+  assert.strictEqual(result.matches.length, 1)
+  assert.strictEqual(result.matches[0].value, 'secret-3-levels')
+})
+
+test('fast-redact: *.*.*.password (4 levels)', () => {
+  const result = testFastRedactDirect('*.*.*.password', {
+    simple: { password: 'secret-2-levels' },
+    user: { auth: { password: 'secret-3-levels' } },
+    nested: { deep: { auth: { password: 'secret-4-levels' } } }
+  })
+
+  assert.strictEqual(result.success, true)
+  assert.strictEqual(result.matches.length, 1)
+  assert.strictEqual(result.matches[0].value, 'secret-4-levels')
+})
+
+test('fast-redact: *.*.*.*.password (5 levels)', () => {
+  const result = testFastRedactDirect('*.*.*.*.password', {
+    simple: { password: 'secret-2-levels' },
+    user: { auth: { password: 'secret-3-levels' } },
+    nested: { deep: { auth: { password: 'secret-4-levels' } } },
+    config: {
+      user: { auth: { settings: { password: 'secret-5-levels' } } }
+    }
+  })
+
+  assert.strictEqual(result.success, true)
+  assert.strictEqual(result.matches.length, 1)
+  assert.strictEqual(result.matches[0].value, 'secret-5-levels')
+})
+
+test('fast-redact: *.*.*.*.*.password (6 levels)', () => {
+  const result = testFastRedactDirect('*.*.*.*.*.password', {
+    simple: { password: 'secret-2-levels' },
+    user: { auth: { password: 'secret-3-levels' } },
+    nested: { deep: { auth: { password: 'secret-4-levels' } } },
+    config: {
+      user: { auth: { settings: { password: 'secret-5-levels' } } }
+    },
+    data: {
+      reqConfig: {
+        data: {
+          credentials: {
+            settings: {
+              password: 'real-secret-6-levels'
+            }
+          }
+        }
+      }
+    }
+  })
+
+  assert.strictEqual(result.success, true)
+  assert.strictEqual(result.matches.length, 1)
+  assert.strictEqual(result.matches[0].value, 'real-secret-6-levels')
+})

node_modules/@pinojs/redact/test/index.test.js

@@ -0,0 +1,824 @@
+const { test } = require('node:test')
+const { strict: assert } = require('node:assert')
+const slowRedact = require('../index.js')
+
+test('basic path redaction', () => {
+  const obj = {
+    headers: {
+      cookie: 'secret-cookie',
+      authorization: 'Bearer token'
+    },
+    body: { message: 'hello' }
+  }
+
+  const redact = slowRedact({ paths: ['headers.cookie'] })
+  const result = redact(obj)
+
+  // Original object should remain unchanged
+  assert.strictEqual(obj.headers.cookie, 'secret-cookie')
+
+  // Result should have redacted path
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.headers.cookie, '[REDACTED]')
+  assert.strictEqual(parsed.headers.authorization, 'Bearer token')
+  assert.strictEqual(parsed.body.message, 'hello')
+})
+
+test('multiple paths redaction', () => {
+  const obj = {
+    user: { name: 'john', password: 'secret' },
+    session: { token: 'abc123' }
+  }
+
+  const redact = slowRedact({
+    paths: ['user.password', 'session.token']
+  })
+  const result = redact(obj)
+
+  // Original unchanged
+  assert.strictEqual(obj.user.password, 'secret')
+  assert.strictEqual(obj.session.token, 'abc123')
+
+  // Result redacted
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.user.password, '[REDACTED]')
+  assert.strictEqual(parsed.session.token, '[REDACTED]')
+  assert.strictEqual(parsed.user.name, 'john')
+})
+
+test('custom censor value', () => {
+  const obj = { secret: 'hidden' }
+  const redact = slowRedact({
+    paths: ['secret'],
+    censor: '***'
+  })
+  const result = redact(obj)
+
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.secret, '***')
+})
+
+test('serialize: false returns object with restore method', () => {
+  const obj = { secret: 'hidden' }
+  const redact = slowRedact({
+    paths: ['secret'],
+    serialize: false
+  })
+  const result = redact(obj)
+
+  // Should be object, not string
+  assert.strictEqual(typeof result, 'object')
+  assert.strictEqual(result.secret, '[REDACTED]')
+
+  // Should have restore method
+  assert.strictEqual(typeof result.restore, 'function')
+
+  const restored = result.restore()
+  assert.strictEqual(restored.secret, 'hidden')
+})
+
+test('bracket notation paths', () => {
+  const obj = {
+    'weird-key': { 'another-weird': 'secret' },
+    normal: 'public'
+  }
+
+  const redact = slowRedact({
+    paths: ['["weird-key"]["another-weird"]']
+  })
+  const result = redact(obj)
+
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed['weird-key']['another-weird'], '[REDACTED]')
+  assert.strictEqual(parsed.normal, 'public')
+})
+
+test('array paths', () => {
+  const obj = {
+    users: [
+      { name: 'john', password: 'secret1' },
+      { name: 'jane', password: 'secret2' }
+    ]
+  }
+
+  const redact = slowRedact({
+    paths: ['users[0].password', 'users[1].password']
+  })
+  const result = redact(obj)
+
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.users[0].password, '[REDACTED]')
+  assert.strictEqual(parsed.users[1].password, '[REDACTED]')
+  assert.strictEqual(parsed.users[0].name, 'john')
+  assert.strictEqual(parsed.users[1].name, 'jane')
+})
+
+test('wildcard at end of path', () => {
+  const obj = {
+    secrets: {
+      key1: 'secret1',
+      key2: 'secret2'
+    },
+    public: 'data'
+  }
+
+  const redact = slowRedact({
+    paths: ['secrets.*']
+  })
+  const result = redact(obj)
+
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.secrets.key1, '[REDACTED]')
+  assert.strictEqual(parsed.secrets.key2, '[REDACTED]')
+  assert.strictEqual(parsed.public, 'data')
+})
+
+test('wildcard with arrays', () => {
+  const obj = {
+    items: ['secret1', 'secret2', 'secret3']
+  }
+
+  const redact = slowRedact({
+    paths: ['items.*']
+  })
+  const result = redact(obj)
+
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.items[0], '[REDACTED]')
+  assert.strictEqual(parsed.items[1], '[REDACTED]')
+  assert.strictEqual(parsed.items[2], '[REDACTED]')
+})
+
+test('intermediate wildcard', () => {
+  const obj = {
+    users: {
+      user1: { password: 'secret1' },
+      user2: { password: 'secret2' }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['users.*.password']
+  })
+  const result = redact(obj)
+
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.users.user1.password, '[REDACTED]')
+  assert.strictEqual(parsed.users.user2.password, '[REDACTED]')
+})
+
+test('censor function', () => {
+  const obj = { secret: 'hidden' }
+  const redact = slowRedact({
+    paths: ['secret'],
+    censor: (value, path) => `REDACTED:${path.join('.')}`
+  })
+  const result = redact(obj)
+
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.secret, 'REDACTED:secret')
+})
+
+test('custom serialize function', () => {
+  const obj = { secret: 'hidden', public: 'data' }
+  const redact = slowRedact({
+    paths: ['secret'],
+    serialize: (obj) => `custom:${JSON.stringify(obj)}`
+  })
+  const result = redact(obj)
+
+  assert(result.startsWith('custom:'))
+  const parsed = JSON.parse(result.slice(7))
+  assert.strictEqual(parsed.secret, '[REDACTED]')
+  assert.strictEqual(parsed.public, 'data')
+})
+
+test('nested paths', () => {
+  const obj = {
+    level1: {
+      level2: {
+        level3: {
+          secret: 'hidden'
+        }
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['level1.level2.level3.secret']
+  })
+  const result = redact(obj)
+
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.level1.level2.level3.secret, '[REDACTED]')
+})
+
+test('non-existent paths are ignored', () => {
+  const obj = { existing: 'value' }
+  const redact = slowRedact({
+    paths: ['nonexistent.path']
+  })
+  const result = redact(obj)
+
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.existing, 'value')
+  assert.strictEqual(parsed.nonexistent, undefined)
+})
+
+test('null and undefined handling', () => {
+  const obj = {
+    nullValue: null,
+    undefinedValue: undefined,
+    nested: {
+      nullValue: null
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['nullValue', 'nested.nullValue']
+  })
+  const result = redact(obj)
+
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.nullValue, '[REDACTED]')
+  assert.strictEqual(parsed.nested.nullValue, '[REDACTED]')
+})
+
+test('original object remains unchanged', () => {
+  const original = {
+    secret: 'hidden',
+    nested: { secret: 'hidden2' }
+  }
+  const copy = JSON.parse(JSON.stringify(original))
+
+  const redact = slowRedact({
+    paths: ['secret', 'nested.secret']
+  })
+  redact(original)
+
+  // Original should be completely unchanged
+  assert.deepStrictEqual(original, copy)
+})
+
+test('strict mode with primitives', () => {
+  const redact = slowRedact({
+    paths: ['test'],
+    strict: true
+  })
+
+  const stringResult = redact('primitive')
+  assert.strictEqual(stringResult, '"primitive"')
+
+  const numberResult = redact(42)
+  assert.strictEqual(numberResult, '42')
+})
+
+// Path validation tests to match fast-redact behavior
+test('path validation - non-string paths should throw', () => {
+  assert.throws(() => {
+    slowRedact({ paths: [123] })
+  }, {
+    message: 'Paths must be (non-empty) strings'
+  })
+
+  assert.throws(() => {
+    slowRedact({ paths: [null] })
+  }, {
+    message: 'Paths must be (non-empty) strings'
+  })
+
+  assert.throws(() => {
+    slowRedact({ paths: [undefined] })
+  }, {
+    message: 'Paths must be (non-empty) strings'
+  })
+})
+
+test('path validation - empty string should throw', () => {
+  assert.throws(() => {
+    slowRedact({ paths: [''] })
+  }, {
+    message: 'Invalid redaction path ()'
+  })
+})
+
+test('path validation - double dots should throw', () => {
+  assert.throws(() => {
+    slowRedact({ paths: ['invalid..path'] })
+  }, {
+    message: 'Invalid redaction path (invalid..path)'
+  })
+
+  assert.throws(() => {
+    slowRedact({ paths: ['a..b..c'] })
+  }, {
+    message: 'Invalid redaction path (a..b..c)'
+  })
+})
+
+test('path validation - unmatched brackets should throw', () => {
+  assert.throws(() => {
+    slowRedact({ paths: ['invalid[unclosed'] })
+  }, {
+    message: 'Invalid redaction path (invalid[unclosed)'
+  })
+
+  assert.throws(() => {
+    slowRedact({ paths: ['invalid]unopened'] })
+  }, {
+    message: 'Invalid redaction path (invalid]unopened)'
+  })
+
+  assert.throws(() => {
+    slowRedact({ paths: ['nested[a[b]'] })
+  }, {
+    message: 'Invalid redaction path (nested[a[b])'
+  })
+})
+
+test('path validation - comma-separated paths should throw', () => {
+  assert.throws(() => {
+    slowRedact({ paths: ['req,headers.cookie'] })
+  }, {
+    message: 'Invalid redaction path (req,headers.cookie)'
+  })
+
+  assert.throws(() => {
+    slowRedact({ paths: ['user,profile,name'] })
+  }, {
+    message: 'Invalid redaction path (user,profile,name)'
+  })
+
+  assert.throws(() => {
+    slowRedact({ paths: ['a,b'] })
+  }, {
+    message: 'Invalid redaction path (a,b)'
+  })
+})
+
+test('path validation - mixed valid and invalid should throw', () => {
+  assert.throws(() => {
+    slowRedact({ paths: ['valid.path', 123, 'another.valid'] })
+  }, {
+    message: 'Paths must be (non-empty) strings'
+  })
+
+  assert.throws(() => {
+    slowRedact({ paths: ['valid.path', 'invalid..path'] })
+  }, {
+    message: 'Invalid redaction path (invalid..path)'
+  })
+
+  assert.throws(() => {
+    slowRedact({ paths: ['valid.path', 'req,headers.cookie'] })
+  }, {
+    message: 'Invalid redaction path (req,headers.cookie)'
+  })
+})
+
+test('path validation - valid paths should work', () => {
+  // These should not throw
+  assert.doesNotThrow(() => {
+    slowRedact({ paths: [] })
+  })
+
+  assert.doesNotThrow(() => {
+    slowRedact({ paths: ['valid.path'] })
+  })
+
+  assert.doesNotThrow(() => {
+    slowRedact({ paths: ['user.password', 'data[0].secret'] })
+  })
+
+  assert.doesNotThrow(() => {
+    slowRedact({ paths: ['["quoted-key"].value'] })
+  })
+
+  assert.doesNotThrow(() => {
+    slowRedact({ paths: ["['single-quoted'].value"] })
+  })
+
+  assert.doesNotThrow(() => {
+    slowRedact({ paths: ['array[0]', 'object.property', 'wildcard.*'] })
+  })
+})
+
+// fast-redact compatibility tests
+test('censor function receives path as array (fast-redact compatibility)', () => {
+  const obj = {
+    headers: {
+      authorization: 'Bearer token',
+      'x-api-key': 'secret-key'
+    }
+  }
+
+  const pathsReceived = []
+  const redact = slowRedact({
+    paths: ['headers.authorization', 'headers["x-api-key"]'],
+    censor: (value, path) => {
+      pathsReceived.push(path)
+      assert(Array.isArray(path), 'Path should be an array')
+      return '[REDACTED]'
+    }
+  })
+
+  redact(obj)
+
+  // Verify paths are arrays
+  assert.strictEqual(pathsReceived.length, 2)
+  assert.deepStrictEqual(pathsReceived[0], ['headers', 'authorization'])
+  assert.deepStrictEqual(pathsReceived[1], ['headers', 'x-api-key'])
+})
+
+test('censor function with nested paths receives correct array', () => {
+  const obj = {
+    user: {
+      profile: {
+        credentials: {
+          password: 'secret123'
+        }
+      }
+    }
+  }
+
+  let receivedPath
+  const redact = slowRedact({
+    paths: ['user.profile.credentials.password'],
+    censor: (value, path) => {
+      receivedPath = path
+      assert.strictEqual(value, 'secret123')
+      assert(Array.isArray(path))
+      return '[REDACTED]'
+    }
+  })
+
+  redact(obj)
+
+  assert.deepStrictEqual(receivedPath, ['user', 'profile', 'credentials', 'password'])
+})
+
+test('censor function with wildcards receives correct array paths', () => {
+  const obj = {
+    users: {
+      user1: { password: 'secret1' },
+      user2: { password: 'secret2' }
+    }
+  }
+
+  const pathsReceived = []
+  const redact = slowRedact({
+    paths: ['users.*.password'],
+    censor: (value, path) => {
+      pathsReceived.push([...path]) // copy the array
+      assert(Array.isArray(path))
+      return '[REDACTED]'
+    }
+  })
+
+  redact(obj)
+
+  assert.strictEqual(pathsReceived.length, 2)
+  assert.deepStrictEqual(pathsReceived[0], ['users', 'user1', 'password'])
+  assert.deepStrictEqual(pathsReceived[1], ['users', 'user2', 'password'])
+})
+
+test('censor function with array wildcard receives correct array paths', () => {
+  const obj = {
+    items: [
+      { secret: 'value1' },
+      { secret: 'value2' }
+    ]
+  }
+
+  const pathsReceived = []
+  const redact = slowRedact({
+    paths: ['items.*.secret'],
+    censor: (value, path) => {
+      pathsReceived.push([...path])
+      assert(Array.isArray(path))
+      return '[REDACTED]'
+    }
+  })
+
+  redact(obj)
+
+  assert.strictEqual(pathsReceived.length, 2)
+  assert.deepStrictEqual(pathsReceived[0], ['items', '0', 'secret'])
+  assert.deepStrictEqual(pathsReceived[1], ['items', '1', 'secret'])
+})
+
+test('censor function with end wildcard receives correct array paths', () => {
+  const obj = {
+    secrets: {
+      key1: 'secret1',
+      key2: 'secret2'
+    }
+  }
+
+  const pathsReceived = []
+  const redact = slowRedact({
+    paths: ['secrets.*'],
+    censor: (value, path) => {
+      pathsReceived.push([...path])
+      assert(Array.isArray(path))
+      return '[REDACTED]'
+    }
+  })
+
+  redact(obj)
+
+  assert.strictEqual(pathsReceived.length, 2)
+  // Sort paths for consistent testing since object iteration order isn't guaranteed
+  pathsReceived.sort((a, b) => a[1].localeCompare(b[1]))
+  assert.deepStrictEqual(pathsReceived[0], ['secrets', 'key1'])
+  assert.deepStrictEqual(pathsReceived[1], ['secrets', 'key2'])
+})
+
+test('type safety: accessing properties on primitive values should not throw', () => {
+  // Test case from GitHub issue #5
+  const redactor = slowRedact({ paths: ['headers.authorization'] })
+  const data = {
+    headers: 123 // primitive value
+  }
+
+  assert.doesNotThrow(() => {
+    const result = redactor(data)
+    const parsed = JSON.parse(result)
+    assert.strictEqual(parsed.headers, 123) // Should remain unchanged
+  })
+
+  // Test wildcards with primitives
+  const redactor2 = slowRedact({ paths: ['data.*.nested'] })
+  const data2 = {
+    data: {
+      item1: 123, // primitive, trying to access .nested on it
+      item2: { nested: 'secret' }
+    }
+  }
+
+  assert.doesNotThrow(() => {
+    const result2 = redactor2(data2)
+    const parsed2 = JSON.parse(result2)
+    assert.strictEqual(parsed2.data.item1, 123) // Primitive unchanged
+    assert.strictEqual(parsed2.data.item2.nested, '[REDACTED]') // Object property redacted
+  })
+
+  // Test deep nested access on primitives
+  const redactor3 = slowRedact({ paths: ['user.name.first.charAt'] })
+  const data3 = {
+    user: {
+      name: 'John' // string primitive
+    }
+  }
+
+  assert.doesNotThrow(() => {
+    const result3 = redactor3(data3)
+    const parsed3 = JSON.parse(result3)
+    assert.strictEqual(parsed3.user.name, 'John') // Should remain unchanged
+  })
+})
+
+// Remove option tests
+test('remove option: basic key removal', () => {
+  const obj = { username: 'john', password: 'secret123' }
+  const redact = slowRedact({ paths: ['password'], remove: true })
+  const result = redact(obj)
+
+  // Original object should remain unchanged
+  assert.strictEqual(obj.password, 'secret123')
+
+  // Result should have password completely removed
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.username, 'john')
+  assert.strictEqual('password' in parsed, false)
+  assert.strictEqual(parsed.password, undefined)
+})
+
+test('remove option: multiple paths removal', () => {
+  const obj = {
+    user: { name: 'john', password: 'secret' },
+    session: { token: 'abc123', id: 'session1' }
+  }
+
+  const redact = slowRedact({
+    paths: ['user.password', 'session.token'],
+    remove: true
+  })
+  const result = redact(obj)
+
+  // Original unchanged
+  assert.strictEqual(obj.user.password, 'secret')
+  assert.strictEqual(obj.session.token, 'abc123')
+
+  // Result has keys completely removed
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.user.name, 'john')
+  assert.strictEqual(parsed.session.id, 'session1')
+  assert.strictEqual('password' in parsed.user, false)
+  assert.strictEqual('token' in parsed.session, false)
+})
+
+test('remove option: wildcard removal', () => {
+  const obj = {
+    secrets: {
+      key1: 'secret1',
+      key2: 'secret2'
+    },
+    public: 'data'
+  }
+
+  const redact = slowRedact({
+    paths: ['secrets.*'],
+    remove: true
+  })
+  const result = redact(obj)
+
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.public, 'data')
+  assert.deepStrictEqual(parsed.secrets, {}) // All keys removed
+})
+
+test('remove option: array wildcard removal', () => {
+  const obj = {
+    items: ['secret1', 'secret2', 'secret3'],
+    meta: 'data'
+  }
+
+  const redact = slowRedact({
+    paths: ['items.*'],
+    remove: true
+  })
+  const result = redact(obj)
+
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.meta, 'data')
+  // Array items set to undefined are omitted by JSON.stringify
+  assert.deepStrictEqual(parsed.items, [null, null, null])
+})
+
+test('remove option: intermediate wildcard removal', () => {
+  const obj = {
+    users: {
+      user1: { password: 'secret1', name: 'john' },
+      user2: { password: 'secret2', name: 'jane' }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['users.*.password'],
+    remove: true
+  })
+  const result = redact(obj)
+
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.users.user1.name, 'john')
+  assert.strictEqual(parsed.users.user2.name, 'jane')
+  assert.strictEqual('password' in parsed.users.user1, false)
+  assert.strictEqual('password' in parsed.users.user2, false)
+})
+
+test('remove option: serialize false returns object with removed keys', () => {
+  const obj = { secret: 'hidden', public: 'data' }
+  const redact = slowRedact({
+    paths: ['secret'],
+    remove: true,
+    serialize: false
+  })
+  const result = redact(obj)
+
+  // Should be object, not string
+  assert.strictEqual(typeof result, 'object')
+  assert.strictEqual(result.public, 'data')
+  assert.strictEqual('secret' in result, false)
+
+  // Should have restore method
+  assert.strictEqual(typeof result.restore, 'function')
+
+  const restored = result.restore()
+  assert.strictEqual(restored.secret, 'hidden')
+})
+
+test('remove option: non-existent paths are ignored', () => {
+  const obj = { existing: 'value' }
+  const redact = slowRedact({
+    paths: ['nonexistent.path'],
+    remove: true
+  })
+  const result = redact(obj)
+
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed.existing, 'value')
+  assert.strictEqual(parsed.nonexistent, undefined)
+})
+
+// Test for Issue #13: Empty string bracket notation paths not being redacted correctly
+test('empty string bracket notation path', () => {
+  const obj = { '': { c: 'sensitive-data' } }
+  const redact = slowRedact({ paths: ["[''].c"] })
+  const result = redact(obj)
+
+  // Original object should remain unchanged
+  assert.strictEqual(obj[''].c, 'sensitive-data')
+
+  // Result should have redacted path
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed[''].c, '[REDACTED]')
+})
+
+test('empty string bracket notation with double quotes', () => {
+  const obj = { '': { c: 'sensitive-data' } }
+  const redact = slowRedact({ paths: ['[""].c'] })
+  const result = redact(obj)
+
+  // Original object should remain unchanged
+  assert.strictEqual(obj[''].c, 'sensitive-data')
+
+  // Result should have redacted path
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed[''].c, '[REDACTED]')
+})
+
+test('empty string key with nested bracket notation', () => {
+  const obj = { '': { '': { secret: 'value' } } }
+  const redact = slowRedact({ paths: ["[''][''].secret"] })
+  const result = redact(obj)
+
+  // Original object should remain unchanged
+  assert.strictEqual(obj[''][''].secret, 'value')
+
+  // Result should have redacted path
+  const parsed = JSON.parse(result)
+  assert.strictEqual(parsed[''][''].secret, '[REDACTED]')
+})
+
+// Test for Pino issue #2313: censor should only be called when path exists
+test('censor function not called for non-existent paths', () => {
+  let censorCallCount = 0
+  const censorCalls = []
+
+  const redact = slowRedact({
+    paths: ['a.b.c', 'req.authorization', 'url'],
+    serialize: false,
+    censor (value, path) {
+      censorCallCount++
+      censorCalls.push({ value, path: path.slice() })
+      return '***'
+    }
+  })
+
+  // Test case 1: { req: { id: 'test' } }
+  // req.authorization doesn't exist, censor should not be called for it
+  censorCallCount = 0
+  censorCalls.length = 0
+  redact({ req: { id: 'test' } })
+
+  // Should not have been called for any path since none exist
+  assert.strictEqual(censorCallCount, 0, 'censor should not be called when paths do not exist')
+
+  // Test case 2: { a: { d: 'test' } }
+  // a.b.c doesn't exist (a.d exists, but not a.b.c)
+  censorCallCount = 0
+  redact({ a: { d: 'test' } })
+  assert.strictEqual(censorCallCount, 0)
+
+  // Test case 3: paths that do exist should still call censor
+  censorCallCount = 0
+  censorCalls.length = 0
+  const result = redact({ req: { authorization: 'bearer token' } })
+  assert.strictEqual(censorCallCount, 1, 'censor should be called when path exists')
+  assert.deepStrictEqual(censorCalls[0].path, ['req', 'authorization'])
+  assert.strictEqual(censorCalls[0].value, 'bearer token')
+  assert.strictEqual(result.req.authorization, '***')
+})
+
+test('censor function not called for non-existent nested paths', () => {
+  let censorCallCount = 0
+
+  const redact = slowRedact({
+    paths: ['headers.authorization'],
+    serialize: false,
+    censor (value, path) {
+      censorCallCount++
+      return '[REDACTED]'
+    }
+  })
+
+  // headers exists but authorization doesn't
+  censorCallCount = 0
+  const result1 = redact({ headers: { 'content-type': 'application/json' } })
+  assert.strictEqual(censorCallCount, 0)
+  assert.deepStrictEqual(result1.headers, { 'content-type': 'application/json' })
+
+  // headers doesn't exist at all
+  censorCallCount = 0
+  const result2 = redact({ body: 'data' })
+  assert.strictEqual(censorCallCount, 0)
+  assert.strictEqual(result2.body, 'data')
+  assert.strictEqual(typeof result2.restore, 'function')
+
+  // headers.authorization exists - should call censor
+  censorCallCount = 0
+  const result3 = redact({ headers: { authorization: 'Bearer token' } })
+  assert.strictEqual(censorCallCount, 1)
+  assert.strictEqual(result3.headers.authorization, '[REDACTED]')
+})

node_modules/@pinojs/redact/test/integration.test.js

@@ -0,0 +1,390 @@
+const { test } = require('node:test')
+const { strict: assert } = require('node:assert')
+const slowRedact = require('../index.js')
+const fastRedact = require('fast-redact')
+
+test('integration: basic path redaction matches fast-redact', () => {
+  const obj = {
+    headers: {
+      cookie: 'secret-cookie',
+      authorization: 'Bearer token'
+    },
+    body: { message: 'hello' }
+  }
+
+  const slowResult = slowRedact({ paths: ['headers.cookie'] })(obj)
+  const fastResult = fastRedact({ paths: ['headers.cookie'] })(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: multiple paths match fast-redact', () => {
+  const obj = {
+    user: { name: 'john', password: 'secret' },
+    session: { token: 'abc123' }
+  }
+
+  const paths = ['user.password', 'session.token']
+  const slowResult = slowRedact({ paths })(obj)
+  const fastResult = fastRedact({ paths })(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: custom censor value matches fast-redact', () => {
+  const obj = { secret: 'hidden' }
+  const options = { paths: ['secret'], censor: '***' }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: bracket notation matches fast-redact', () => {
+  const obj = {
+    'weird-key': { 'another-weird': 'secret' },
+    normal: 'public'
+  }
+
+  const options = { paths: ['["weird-key"]["another-weird"]'] }
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: array paths match fast-redact', () => {
+  const obj = {
+    users: [
+      { name: 'john', password: 'secret1' },
+      { name: 'jane', password: 'secret2' }
+    ]
+  }
+
+  const options = { paths: ['users[0].password', 'users[1].password'] }
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: wildcard at end matches fast-redact', () => {
+  const obj = {
+    secrets: {
+      key1: 'secret1',
+      key2: 'secret2'
+    },
+    public: 'data'
+  }
+
+  const options = { paths: ['secrets.*'] }
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: wildcard with arrays matches fast-redact', () => {
+  const obj = {
+    items: ['secret1', 'secret2', 'secret3']
+  }
+
+  const options = { paths: ['items.*'] }
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: intermediate wildcard matches fast-redact', () => {
+  const obj = {
+    users: {
+      user1: { password: 'secret1' },
+      user2: { password: 'secret2' }
+    }
+  }
+
+  const options = { paths: ['users.*.password'] }
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: custom serialize function matches fast-redact', () => {
+  const obj = { secret: 'hidden', public: 'data' }
+  const options = {
+    paths: ['secret'],
+    serialize: (obj) => `custom:${JSON.stringify(obj)}`
+  }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: nested paths match fast-redact', () => {
+  const obj = {
+    level1: {
+      level2: {
+        level3: {
+          secret: 'hidden'
+        }
+      }
+    }
+  }
+
+  const options = { paths: ['level1.level2.level3.secret'] }
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: non-existent paths match fast-redact', () => {
+  const obj = { existing: 'value' }
+  const options = { paths: ['nonexistent.path'] }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: null and undefined handling - legitimate difference', () => {
+  const obj = {
+    nullValue: null,
+    undefinedValue: undefined,
+    nested: {
+      nullValue: null
+    }
+  }
+
+  const options = { paths: ['nullValue', 'nested.nullValue'] }
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  // This is a legitimate behavioral difference:
+  // @pinojs/redact redacts null values, fast-redact doesn't
+  const slowParsed = JSON.parse(slowResult)
+  const fastParsed = JSON.parse(fastResult)
+
+  // @pinojs/redact redacts nulls
+  assert.strictEqual(slowParsed.nullValue, '[REDACTED]')
+  assert.strictEqual(slowParsed.nested.nullValue, '[REDACTED]')
+
+  // fast-redact preserves nulls
+  assert.strictEqual(fastParsed.nullValue, null)
+  assert.strictEqual(fastParsed.nested.nullValue, null)
+})
+
+test('integration: strict mode with primitives - different error handling', () => {
+  const options = { paths: ['test'], strict: true }
+
+  const slowRedactFn = slowRedact(options)
+  const fastRedactFn = fastRedact(options)
+
+  // @pinojs/redact handles primitives gracefully
+  const stringSlowResult = slowRedactFn('primitive')
+  assert.strictEqual(stringSlowResult, '"primitive"')
+
+  const numberSlowResult = slowRedactFn(42)
+  assert.strictEqual(numberSlowResult, '42')
+
+  // fast-redact throws an error for primitives in strict mode
+  assert.throws(() => {
+    fastRedactFn('primitive')
+  }, /primitives cannot be redacted/)
+
+  assert.throws(() => {
+    fastRedactFn(42)
+  }, /primitives cannot be redacted/)
+})
+
+test('integration: serialize false behavior difference', () => {
+  const slowObj = { secret: 'hidden' }
+  const fastObj = { secret: 'hidden' }
+  const options = { paths: ['secret'], serialize: false }
+
+  const slowResult = slowRedact(options)(slowObj)
+  const fastResult = fastRedact(options)(fastObj)
+
+  // Both should redact the secret
+  assert.strictEqual(slowResult.secret, '[REDACTED]')
+  assert.strictEqual(fastResult.secret, '[REDACTED]')
+
+  // @pinojs/redact always has restore method
+  assert.strictEqual(typeof slowResult.restore, 'function')
+
+  // @pinojs/redact should restore to original value
+  assert.strictEqual(slowResult.restore().secret, 'hidden')
+
+  // Key difference: original object state
+  // fast-redact mutates the original, @pinojs/redact doesn't
+  assert.strictEqual(slowObj.secret, 'hidden') // @pinojs/redact preserves original
+  assert.strictEqual(fastObj.secret, '[REDACTED]') // fast-redact mutates original
+})
+
+test('integration: censor function behavior', () => {
+  const obj = { secret: 'hidden' }
+  const options = {
+    paths: ['secret'],
+    censor: (value, path) => `REDACTED:${path}`
+  }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: complex object with mixed patterns', () => {
+  const obj = {
+    users: [
+      {
+        id: 1,
+        name: 'john',
+        credentials: { password: 'secret1', apiKey: 'key1' }
+      },
+      {
+        id: 2,
+        name: 'jane',
+        credentials: { password: 'secret2', apiKey: 'key2' }
+      }
+    ],
+    config: {
+      database: { password: 'db-secret' },
+      api: { keys: ['key1', 'key2', 'key3'] }
+    }
+  }
+
+  const options = {
+    paths: [
+      'users.*.credentials.password',
+      'users.*.credentials.apiKey',
+      'config.database.password',
+      'config.api.keys.*'
+    ]
+  }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+// Remove option integration tests - comparing with fast-redact
+test('integration: remove option basic comparison with fast-redact', () => {
+  const obj = { username: 'john', password: 'secret123' }
+  const options = { paths: ['password'], remove: true }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+
+  // Verify the key is actually removed
+  const parsed = JSON.parse(slowResult)
+  assert.strictEqual(parsed.username, 'john')
+  assert.strictEqual('password' in parsed, false)
+})
+
+test('integration: remove option multiple paths comparison with fast-redact', () => {
+  const obj = {
+    user: { name: 'john', password: 'secret' },
+    session: { token: 'abc123', id: 'session1' }
+  }
+
+  const options = {
+    paths: ['user.password', 'session.token'],
+    remove: true
+  }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: remove option wildcard comparison with fast-redact', () => {
+  const obj = {
+    secrets: {
+      key1: 'secret1',
+      key2: 'secret2'
+    },
+    public: 'data'
+  }
+
+  const options = {
+    paths: ['secrets.*'],
+    remove: true
+  }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: remove option intermediate wildcard comparison with fast-redact', () => {
+  const obj = {
+    users: {
+      user1: { password: 'secret1', name: 'john' },
+      user2: { password: 'secret2', name: 'jane' }
+    }
+  }
+
+  const options = {
+    paths: ['users.*.password'],
+    remove: true
+  }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+})
+
+test('integration: remove option with custom censor comparison with fast-redact', () => {
+  const obj = { secret: 'hidden', public: 'data' }
+  const options = {
+    paths: ['secret'],
+    censor: '***',
+    remove: true
+  }
+
+  const slowResult = slowRedact(options)(obj)
+  const fastResult = fastRedact(options)(obj)
+
+  assert.strictEqual(slowResult, fastResult)
+
+  // With remove: true, censor value should be ignored
+  const parsed = JSON.parse(slowResult)
+  assert.strictEqual('secret' in parsed, false)
+  assert.strictEqual(parsed.public, 'data')
+})
+
+test('integration: remove option serialize false behavior - @pinojs/redact only', () => {
+  // fast-redact doesn't support remove option with serialize: false
+  // so we test @pinojs/redact's behavior only
+  const obj = { secret: 'hidden', public: 'data' }
+  const options = { paths: ['secret'], remove: true, serialize: false }
+
+  const result = slowRedact(options)(obj)
+
+  // Should have the key removed
+  assert.strictEqual('secret' in result, false)
+  assert.strictEqual(result.public, 'data')
+
+  // Should have restore method
+  assert.strictEqual(typeof result.restore, 'function')
+
+  // Original object should be preserved
+  assert.strictEqual(obj.secret, 'hidden')
+
+  // Restore should bring back the removed key
+  const restored = result.restore()
+  assert.strictEqual(restored.secret, 'hidden')
+})

node_modules/@pinojs/redact/test/multiple-wildcards.test.js

@@ -0,0 +1,227 @@
+'use strict'
+
+const { test } = require('node:test')
+const { strict: assert } = require('node:assert')
+const slowRedact = require('../index.js')
+
+// Tests for Issue #2319: @pinojs/redact fails to redact patterns with 3+ consecutive wildcards
+test('three consecutive wildcards: *.*.*.password (4 levels deep)', () => {
+  const obj = {
+    simple: { password: 'secret-2-levels' },
+    user: { auth: { password: 'secret-3-levels' } },
+    nested: { deep: { auth: { password: 'secret-4-levels' } } }
+  }
+
+  const redact = slowRedact({
+    paths: ['*.*.*.password']
+  })
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // Only the 4-level deep password should be redacted
+  assert.strictEqual(parsed.simple.password, 'secret-2-levels', '2-level password should NOT be redacted')
+  assert.strictEqual(parsed.user.auth.password, 'secret-3-levels', '3-level password should NOT be redacted')
+  assert.strictEqual(parsed.nested.deep.auth.password, '[REDACTED]', '4-level password SHOULD be redacted')
+})
+
+test('four consecutive wildcards: *.*.*.*.password (5 levels deep)', () => {
+  const obj = {
+    simple: { password: 'secret-2-levels' },
+    user: { auth: { password: 'secret-3-levels' } },
+    nested: { deep: { auth: { password: 'secret-4-levels' } } },
+    config: { user: { auth: { settings: { password: 'secret-5-levels' } } } }
+  }
+
+  const redact = slowRedact({
+    paths: ['*.*.*.*.password']
+  })
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // Only the 5-level deep password should be redacted
+  assert.strictEqual(parsed.simple.password, 'secret-2-levels', '2-level password should NOT be redacted')
+  assert.strictEqual(parsed.user.auth.password, 'secret-3-levels', '3-level password should NOT be redacted')
+  assert.strictEqual(parsed.nested.deep.auth.password, 'secret-4-levels', '4-level password should NOT be redacted')
+  assert.strictEqual(parsed.config.user.auth.settings.password, '[REDACTED]', '5-level password SHOULD be redacted')
+})
+
+test('five consecutive wildcards: *.*.*.*.*.password (6 levels deep)', () => {
+  const obj = {
+    simple: { password: 'secret-2-levels' },
+    user: { auth: { password: 'secret-3-levels' } },
+    nested: { deep: { auth: { password: 'secret-4-levels' } } },
+    config: { user: { auth: { settings: { password: 'secret-5-levels' } } } },
+    data: {
+      reqConfig: {
+        data: {
+          credentials: {
+            settings: {
+              password: 'secret-6-levels'
+            }
+          }
+        }
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['*.*.*.*.*.password']
+  })
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // Only the 6-level deep password should be redacted
+  assert.strictEqual(parsed.simple.password, 'secret-2-levels', '2-level password should NOT be redacted')
+  assert.strictEqual(parsed.user.auth.password, 'secret-3-levels', '3-level password should NOT be redacted')
+  assert.strictEqual(parsed.nested.deep.auth.password, 'secret-4-levels', '4-level password should NOT be redacted')
+  assert.strictEqual(parsed.config.user.auth.settings.password, 'secret-5-levels', '5-level password should NOT be redacted')
+  assert.strictEqual(parsed.data.reqConfig.data.credentials.settings.password, '[REDACTED]', '6-level password SHOULD be redacted')
+})
+
+test('three wildcards with censor function receives correct values', () => {
+  const obj = {
+    nested: { deep: { auth: { password: 'secret-value' } } }
+  }
+
+  const censorCalls = []
+  const redact = slowRedact({
+    paths: ['*.*.*.password'],
+    censor: (value, path) => {
+      censorCalls.push({ value, path: [...path] })
+      return '[REDACTED]'
+    }
+  })
+
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // Should have been called exactly once with the correct value
+  assert.strictEqual(censorCalls.length, 1, 'censor should be called once')
+  assert.strictEqual(censorCalls[0].value, 'secret-value', 'censor should receive the actual value')
+  assert.deepStrictEqual(censorCalls[0].path, ['nested', 'deep', 'auth', 'password'], 'censor should receive correct path')
+  assert.strictEqual(parsed.nested.deep.auth.password, '[REDACTED]')
+})
+
+test('three wildcards with multiple matches', () => {
+  const obj = {
+    api1: { v1: { auth: { token: 'token1' } } },
+    api2: { v2: { auth: { token: 'token2' } } },
+    api3: { v1: { auth: { token: 'token3' } } }
+  }
+
+  const redact = slowRedact({
+    paths: ['*.*.*.token']
+  })
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // All three tokens should be redacted
+  assert.strictEqual(parsed.api1.v1.auth.token, '[REDACTED]')
+  assert.strictEqual(parsed.api2.v2.auth.token, '[REDACTED]')
+  assert.strictEqual(parsed.api3.v1.auth.token, '[REDACTED]')
+})
+
+test('three wildcards with remove option', () => {
+  const obj = {
+    nested: { deep: { auth: { password: 'secret', username: 'admin' } } }
+  }
+
+  const redact = slowRedact({
+    paths: ['*.*.*.password'],
+    remove: true
+  })
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // Password should be removed entirely
+  assert.strictEqual('password' in parsed.nested.deep.auth, false, 'password key should be removed')
+  assert.strictEqual(parsed.nested.deep.auth.username, 'admin', 'username should remain')
+})
+
+test('mixed: two and three wildcards in same redactor', () => {
+  const obj = {
+    user: { auth: { password: 'secret-3-levels' } },
+    config: { deep: { auth: { password: 'secret-4-levels' } } }
+  }
+
+  const redact = slowRedact({
+    paths: ['*.*.password', '*.*.*.password']
+  })
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // Both should be redacted
+  assert.strictEqual(parsed.user.auth.password, '[REDACTED]', '3-level should be redacted by *.*.password')
+  assert.strictEqual(parsed.config.deep.auth.password, '[REDACTED]', '4-level should be redacted by *.*.*.password')
+})
+
+test('three wildcards should not call censor for non-existent paths', () => {
+  const obj = {
+    shallow: { data: 'value' },
+    nested: { deep: { auth: { password: 'secret' } } }
+  }
+
+  let censorCallCount = 0
+  const redact = slowRedact({
+    paths: ['*.*.*.password'],
+    censor: (value, path) => {
+      censorCallCount++
+      return '[REDACTED]'
+    }
+  })
+
+  redact(obj)
+
+  // Should only be called once for the path that exists
+  assert.strictEqual(censorCallCount, 1, 'censor should only be called for existing paths')
+})
+
+test('three wildcards with arrays', () => {
+  const obj = {
+    users: [
+      { auth: { password: 'secret1' } },
+      { auth: { password: 'secret2' } }
+    ]
+  }
+
+  const redact = slowRedact({
+    paths: ['*.*.*.password']
+  })
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // Both passwords should be redacted (users[0].auth.password is 4 levels)
+  assert.strictEqual(parsed.users[0].auth.password, '[REDACTED]')
+  assert.strictEqual(parsed.users[1].auth.password, '[REDACTED]')
+})
+
+test('four wildcards with authorization header (real-world case)', () => {
+  const obj = {
+    requests: {
+      api1: {
+        config: {
+          headers: {
+            authorization: 'Bearer secret-token'
+          }
+        }
+      },
+      api2: {
+        config: {
+          headers: {
+            authorization: 'Bearer another-token'
+          }
+        }
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['*.*.*.*.authorization']
+  })
+  const result = redact(obj)
+  const parsed = JSON.parse(result)
+
+  // Both authorization headers should be redacted
+  assert.strictEqual(parsed.requests.api1.config.headers.authorization, '[REDACTED]')
+  assert.strictEqual(parsed.requests.api2.config.headers.authorization, '[REDACTED]')
+})

node_modules/@pinojs/redact/test/prototype-pollution.test.js

@@ -0,0 +1,223 @@
+const { test } = require('node:test')
+const { strict: assert } = require('node:assert')
+const slowRedact = require('../index.js')
+
+/* eslint-disable no-proto */
+
+test('prototype pollution: __proto__ path should not pollute Object prototype', () => {
+  const obj = {
+    user: { name: 'john' },
+    __proto__: { isAdmin: true }
+  }
+
+  const redact = slowRedact({
+    paths: ['__proto__.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact the __proto__ property if it exists as a regular property
+  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: constructor.prototype path should not pollute', () => {
+  const obj = {
+    user: { name: 'john' },
+    constructor: {
+      prototype: { isAdmin: true }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['constructor.prototype.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact the constructor.prototype property if it exists as a regular property
+  assert.strictEqual(result.constructor.prototype.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: nested __proto__ should not pollute', () => {
+  const obj = {
+    user: {
+      settings: {
+        __proto__: { isAdmin: true }
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['user.settings.__proto__.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact the nested __proto__ property
+  assert.strictEqual(result.user.settings.__proto__.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: bracket notation __proto__ should not pollute', () => {
+  const obj = {
+    user: { name: 'john' },
+    __proto__: { isAdmin: true }
+  }
+
+  const redact = slowRedact({
+    paths: ['["__proto__"]["isAdmin"]'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact the __proto__ property when accessed via bracket notation
+  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: wildcard with __proto__ should not pollute', () => {
+  const obj = {
+    users: {
+      __proto__: { isAdmin: true },
+      user1: { name: 'john' },
+      user2: { name: 'jane' }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['users.*'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact only own properties
+  assert.strictEqual(result.users.user1, '[REDACTED]')
+  assert.strictEqual(result.users.user2, '[REDACTED]')
+
+  // __proto__ should only be redacted if it's an own property, not inherited
+  if (Object.prototype.hasOwnProperty.call(obj.users, '__proto__')) {
+    assert.strictEqual(result.users.__proto__, '[REDACTED]')
+  }
+})
+
+test('prototype pollution: malicious JSON payload should not pollute', () => {
+  // Simulate a malicious payload that might come from JSON.parse
+  const maliciousObj = JSON.parse('{"user": {"name": "john"}, "__proto__": {"isAdmin": true}}')
+
+  const redact = slowRedact({
+    paths: ['__proto__.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(maliciousObj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // The malicious payload should have been redacted
+  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: verify prototype chain is preserved', () => {
+  function CustomClass () {
+    this.data = 'test'
+  }
+  CustomClass.prototype.method = function () { return 'original' }
+
+  const obj = new CustomClass()
+
+  const redact = slowRedact({
+    paths: ['data'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should redact the data property
+  assert.strictEqual(result.data, '[REDACTED]')
+
+  // Should preserve the original prototype chain
+  assert.strictEqual(result.method(), 'original')
+  assert.strictEqual(Object.getPrototypeOf(result), CustomClass.prototype)
+})
+
+test('prototype pollution: setValue should not create prototype pollution', () => {
+  const obj = { user: { name: 'john' } }
+
+  // Try to pollute via non-existent path that could create __proto__
+  const redact = slowRedact({
+    paths: ['__proto__.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should not create the path if it doesn't exist
+  // The __proto__ property may exist due to Object.create, but should not contain our redacted value
+  if (result.__proto__) {
+    assert.strictEqual(result.__proto__.isAdmin, undefined)
+  }
+})
+
+test('prototype pollution: deep nested prototype properties should not pollute', () => {
+  const obj = {
+    level1: {
+      level2: {
+        level3: {
+          __proto__: { isAdmin: true },
+          constructor: {
+            prototype: { isEvil: true }
+          }
+        }
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: [
+      'level1.level2.level3.__proto__.isAdmin',
+      'level1.level2.level3.constructor.prototype.isEvil'
+    ],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual(Object.prototype.isEvil, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+  assert.strictEqual({}.isEvil, undefined)
+
+  // Should redact the deep nested properties
+  assert.strictEqual(result.level1.level2.level3.__proto__.isAdmin, '[REDACTED]')
+  assert.strictEqual(result.level1.level2.level3.constructor.prototype.isEvil, '[REDACTED]')
+})

node_modules/@pinojs/redact/test/selective-clone.test.js

@@ -0,0 +1,115 @@
+const { test } = require('node:test')
+const { strict: assert } = require('node:assert')
+const slowRedact = require('../index.js')
+
+test('selective cloning shares references for non-redacted paths', () => {
+  const sharedObject = { unchanged: 'data' }
+  const obj = {
+    toRedact: 'secret',
+    shared: sharedObject,
+    nested: {
+      toRedact: 'secret2',
+      shared: sharedObject
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['toRedact', 'nested.toRedact'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Redacted values should be different
+  assert.strictEqual(result.toRedact, '[REDACTED]')
+  assert.strictEqual(result.nested.toRedact, '[REDACTED]')
+
+  // Non-redacted references should be shared (same object reference)
+  assert.strictEqual(result.shared, obj.shared)
+  assert.strictEqual(result.nested.shared, obj.nested.shared)
+
+  // The shared object should be the exact same reference
+  assert.strictEqual(result.shared, sharedObject)
+  assert.strictEqual(result.nested.shared, sharedObject)
+})
+
+test('selective cloning works with arrays', () => {
+  const sharedItem = { unchanged: 'data' }
+  const obj = {
+    items: [
+      { secret: 'hidden1', shared: sharedItem },
+      { secret: 'hidden2', shared: sharedItem },
+      sharedItem
+    ]
+  }
+
+  const redact = slowRedact({
+    paths: ['items.*.secret'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Secrets should be redacted
+  assert.strictEqual(result.items[0].secret, '[REDACTED]')
+  assert.strictEqual(result.items[1].secret, '[REDACTED]')
+
+  // Shared references should be preserved where possible
+  // Note: array items with secrets will be cloned, but their shared properties should still reference the original
+  assert.strictEqual(result.items[0].shared, sharedItem)
+  assert.strictEqual(result.items[1].shared, sharedItem)
+
+  // The third item gets cloned due to wildcard, but should have the same content
+  assert.deepStrictEqual(result.items[2], sharedItem)
+  // Note: Due to wildcard '*', all array items are cloned, even if they don't need redaction
+  // This is still a significant optimization for object properties that aren't in wildcard paths
+})
+
+test('selective cloning with no paths returns original object', () => {
+  const obj = { data: 'unchanged' }
+  const redact = slowRedact({
+    paths: [],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should return the exact same object reference
+  assert.strictEqual(result, obj)
+})
+
+test('selective cloning performance - large objects with minimal redaction', () => {
+  // Create a large object with mostly shared data
+  const sharedData = { large: 'data'.repeat(1000) }
+  const obj = {
+    secret: 'hidden',
+    shared1: sharedData,
+    shared2: sharedData,
+    nested: {
+      secret: 'hidden2',
+      shared3: sharedData,
+      deep: {
+        shared4: sharedData,
+        moreShared: sharedData
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['secret', 'nested.secret'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Verify redaction worked
+  assert.strictEqual(result.secret, '[REDACTED]')
+  assert.strictEqual(result.nested.secret, '[REDACTED]')
+
+  // Verify shared references are preserved
+  assert.strictEqual(result.shared1, sharedData)
+  assert.strictEqual(result.shared2, sharedData)
+  assert.strictEqual(result.nested.shared3, sharedData)
+  assert.strictEqual(result.nested.deep.shared4, sharedData)
+  assert.strictEqual(result.nested.deep.moreShared, sharedData)
+})