@capxul/observability 4.1.4 → 4.2.0-rc.1

package/README.md

@@ -26,23 +26,28 @@ optional and snake_case; the camelCase spellings are retired.
 One boundary, two named postures, both built on the same sanitizer, token
 guard and missing-key opt-out:
 
-|                 | `utilityAppAnalytics`                      | `productAppAnalytics`                   |
-| --------------- | ------------------------------------------ | --------------------------------------- |
-| For             | capability-URL apps (approval links, docs) | the Capxul product web app              |
-| Persistence     | off                                        | **on** — J1 spans an OTP reload         |
-| Person profiles | identified-only, nothing identifies        | identified-only, identify-driven        |
-| Autocapture     | off                                        | off                                     |
-| Session replay  | off                                        | **on in every environment**, OTP masked |
-| Exceptions      | off                                        | on                                      |
-
-Both stamp `capxul_env` and `producer: "browser"` through `before_send`, which
-also recursively removes URL query strings/fragments (including exception-frame
-filenames) and promoted campaign/search values. Pair either with
-`createPostHogBrowserPageviewTracker`, which reports pathname-only initial
-loads and SPA route changes. Vendor initialization and pageview capture
-failures degrade to disabled analytics. The product profile records ordinary
-text and input values. It masks inputs whose `autocomplete` attribute is
-`one-time-code`.
+|                 | `utilityAppAnalytics`                      | `productAppAnalytics`                           |
+| --------------- | ------------------------------------------ | ----------------------------------------------- |
+| For             | capability-URL apps (approval links, docs) | the Capxul product web app                      |
+| Persistence     | off                                        | **on** — J1 spans an OTP reload                 |
+| Person profiles | identified-only, nothing identifies        | identified-only, identify-driven                |
+| Autocapture     | off                                        | off                                             |
+| Session replay  | off                                        | **on in every environment**, credentials masked |
+| Exceptions      | off                                        | on                                              |
+
+Both stamp `capxul_env` and `producer: "browser"` through `before_send`.
+Utility analytics removes URL queries, fragments, and promoted campaign/search
+values. Product analytics preserves safe URL components and masks credentials.
+Both profiles preserve the PostHog routing token required for transport.
+`createPostHogBrowserPageviewTracker` reports pathname-only initial loads and
+SPA route changes. Vendor initialization and pageview capture failures degrade
+to disabled analytics.
+
+[The redaction rule](../../docs/rules/redaction.md) defines the data classes.
+Product replay masks password, OTP, and credential controls. Ordinary input
+remains visible. Network copies mask credential fields, headers, and URL parts
+while retaining safe codes, public chain evidence, and replay identifiers.
+Existing event schemas and the four auth-event email hashes remain unchanged.
 
 ### Import the standard `posthog-js` build
 

package/dist/capxul-source.json

@@ -0,0 +1,11 @@
+{
+  "source": {
+    "commit": "efa1ae30674425e4db92020bfad513fb6cf36011",
+    "tree": "91f805524a7c7b53e6c28cf484b549b0c1dbd9dd",
+    "branch": "codex/programme-rc",
+    "repository": "https://github.com/Xelmar-tech/infrastructure",
+    "lockfileSha256": "5870f53b72706d103220c1bcf733cb4fb71196aea32a9cfbdc277d73cc959264"
+  },
+  "name": "@capxul/observability",
+  "version": "4.2.0-rc.1"
+}

package/dist/engineering.d.mts

@@ -12,7 +12,7 @@ interface EngineeringTelemetryConfig {
   readonly sdkVersion: string;
   readonly serviceName?: string;
 }
-declare const traceHeaderFilter: (name: string) => boolean;
+declare const traceHeaderFilter: (_name: string) => boolean;
 declare const postHogOtlpEndpoints: (host: string) => {
   readonly logs: `${string}/i/v1/logs`;
   readonly traces: `${string}/i/v1/traces`;

package/dist/engineering.mjs

@@ -1,4 +1,5 @@
-import { Cause, Effect, Exit, Layer, Tracer } from "effect";
+import { i as redactUrlSecrets, n as isCredentialField, r as redactSecrets } from "./src-CWfRYsBI.mjs";
+import { Cause, Effect, Exit, FiberSet, Layer, Stream, Tracer } from "effect";
 import { FetchHttpClient, Headers, HttpClient } from "effect/unstable/http";
 import { OtlpExporter, OtlpLogger, OtlpSerialization, OtlpTracer } from "effect/unstable/observability";
 //#region src/engineering.ts
@@ -8,21 +9,8 @@ const ENGINEERING_CAPXUL_ENVS = [
 	"production",
 	"local"
 ];
-const SAFE_TRACED_HEADER_NAMES = [
-	"content-length",
-	"content-type",
-	"traceparent",
-	"tracestate",
-	"x-request-id"
-];
-const ENGINEERING_REDACTED_HEADER_NAMES = Object.freeze([
-	"authorization",
-	"cookie",
-	"set-cookie",
-	"x-api-key",
-	/auth|email|key|otp|secret|session|token|wallet/i
-]);
-const traceHeaderFilter = (name) => SAFE_TRACED_HEADER_NAMES.includes(name.toLowerCase());
+const traceHeaderFilter = (_name) => true;
+const credentialHeaderPattern = Object.assign(/./u, { test: (name) => isCredentialField(name, "header") });
 const postHogOtlpEndpoints = (host) => {
 	const base = host.replace(/\/+$/, "");
 	return {
@@ -54,23 +42,79 @@ const validateEngineeringTelemetryConfig = (config) => {
 		headers: Object.freeze({ authorization: headerEntries[0][1] })
 	};
 };
-var RedactedEngineeringSpanFailure = class extends Error {
-	constructor() {
-		super("Engineering operation failed");
-		this.name = "RedactedEngineeringSpanFailure";
-		delete this.stack;
+const failureText = (failure, key, limit, source) => {
+	if (failure === null || typeof failure !== "object") return void 0;
+	try {
+		let owner = failure;
+		let descriptor;
+		for (let depth = 0; owner !== null && depth < 4; depth += 1) {
+			descriptor = Object.getOwnPropertyDescriptor(owner, key);
+			if (descriptor !== void 0 || key !== "name") break;
+			owner = Object.getPrototypeOf(owner);
+		}
+		const value = descriptor?.value;
+		return typeof value === "string" || key === "code" && typeof value === "number" ? redactSecrets(String(value), source).slice(0, limit) : void 0;
+	} catch {
+		return;
+	}
+};
+const exportFailure = (failure, source) => {
+	const message = failureText(failure, "message", 2048, source) ?? (typeof failure === "string" ? redactSecrets(failure, source).slice(0, 2048) : "Engineering operation failed");
+	const code = failureText(failure, "code", 128);
+	const error = new Error((code === void 0 ? message : `${message} [code=${code}]`).slice(0, 2048));
+	error.name = failureText(failure, "_tag", 128) ?? failureText(failure, "name", 128) ?? "Error";
+	error.stack = failureText(failure, "stack", 8192, source) ?? `${error.name}: ${error.message}`;
+	return error;
+};
+const exportFailureExit = (cause, source) => Exit.failCause(Cause.fromReasons(cause.reasons.filter((reason) => !Cause.isInterruptReason(reason)).slice(0, 8).map((reason) => Cause.isFailReason(reason) ? Cause.makeFailReason(exportFailure(reason.error, source)) : Cause.makeDieReason(exportFailure(reason.defect, source)))));
+const BROWSER_KEEPALIVE_BYTES = 65536;
+let unfinishedBrowserExportBytes = 0;
+const hasBrowserDocument = () => typeof window !== "undefined" && typeof document !== "undefined";
+const browserExportClient = (client) => HttpClient.transform(client, (response, request) => Effect.acquireUseRelease(Effect.sync(() => {
+	const bytes = "contentLength" in request.body ? request.body.contentLength : void 0;
+	if (request.body._tag === "Stream" || request.body._tag === "FormData" || bytes === void 0 || !Number.isSafeInteger(bytes) || bytes < 0 || unfinishedBrowserExportBytes + bytes > BROWSER_KEEPALIVE_BYTES) return;
+	unfinishedBrowserExportBytes += bytes;
+	return bytes;
+}), (bytes) => response.pipe(Effect.provideService(FetchHttpClient.RequestInit, { keepalive: bytes !== void 0 }), Effect.tap((result) => bytes === void 0 ? Effect.void : Stream.runDrain(result.stream).pipe(Effect.catch((error) => error.reason._tag === "EmptyBodyError" ? Effect.void : Effect.fail(error))))), (bytes) => Effect.sync(() => {
+	if (bytes !== void 0) unfinishedBrowserExportBytes -= bytes;
+})));
+const spanUpstream = (span) => {
+	let current = span;
+	while (current?._tag === "Span") {
+		const upstream = current.attributes.get("chain.upstream");
+		if (upstream === "alchemy" || upstream === "infura") return upstream;
+		current = current.parent._tag === "Some" ? current.parent.value : void 0;
 	}
 };
-const REDACTED_SPAN_FAILURE = Exit.fail(new RedactedEngineeringSpanFailure());
 /** Preserve domain exits while preventing the OTLP serializer from seeing raw causes. */
 const makeLeakSafeEngineeringTracer = (delegate) => Tracer.make({
 	span(options) {
 		const span = delegate.span(options);
 		const wrapped = Object.create(span);
+		Object.defineProperty(wrapped, "attribute", { value: (name, value) => {
+			const source = spanUpstream(span);
+			const header = /^http\.(?:request|response)\.header\.(.+)$/u.exec(name)?.[1];
+			if (header !== void 0 && isCredentialField(header, "header")) span.attribute(name, "[REDACTED]");
+			else if (typeof value === "string" && name === "url.query") span.attribute(name, redactUrlSecrets(`?${value}`).slice(1, 2049));
+			else if (typeof value === "string" && name === "url.path") {
+				const fullUrl = span.attributes.get("url.full");
+				const path = typeof fullUrl === "string" ? /^https?:\/\/[^/]+([^?#]*)/u.exec(fullUrl)?.[1] ?? value : value;
+				span.attribute(name, redactUrlSecrets(path, source).slice(0, 2048));
+			} else if (typeof value === "string" && (name === "url.full" || header === "location" || header === "referer" || header === "referrer")) span.attribute(name, redactUrlSecrets(value, source).slice(0, 2048));
+			else if (header !== void 0 && typeof value === "string") span.attribute(name, redactSecrets(value, source).slice(0, 2048));
+			else span.attribute(name, value);
+		} });
 		Object.defineProperty(wrapped, "end", {
 			configurable: false,
 			enumerable: false,
-			value: (endTime, exit) => span.end(endTime, Exit.isFailure(exit) && !Cause.hasInterruptsOnly(exit.cause) ? REDACTED_SPAN_FAILURE : exit),
+			value: (endTime, exit) => {
+				if (Exit.isFailure(exit) && !Cause.hasInterruptsOnly(exit.cause)) {
+					const first = exit.cause.reasons.find((reason) => !Cause.isInterruptReason(reason));
+					const code = failureText(first === void 0 ? void 0 : Cause.isFailReason(first) ? first.error : first.defect, "code", 128);
+					if (code !== void 0) span.attribute("error.code", code);
+					span.end(endTime, exportFailureExit(exit.cause, spanUpstream(span)));
+				} else span.end(endTime, exit);
+			},
 			writable: false
 		});
 		return wrapped;
@@ -101,8 +145,29 @@ const makeEngineeringTelemetryLayer = (config) => {
 		resource,
 		mergeWithExisting: true
 	});
-	const headerPolicy = Layer.merge(Layer.succeed(HttpClient.TracerHeaderFilter, traceHeaderFilter), Layer.succeed(Headers.CurrentRedactedNames, ENGINEERING_REDACTED_HEADER_NAMES));
-	return Layer.mergeAll(tracing, logging, headerPolicy).pipe(Layer.provide(OtlpSerialization.layerJson), Layer.provide(FetchHttpClient.layer));
+	const headerPolicy = Layer.merge(Layer.succeed(HttpClient.TracerHeaderFilter, traceHeaderFilter), Layer.succeed(Headers.CurrentRedactedNames, [credentialHeaderPattern]));
+	const browserLifecycle = Layer.effectDiscard(Effect.gen(function* () {
+		if (validated.producer !== "browser" || !hasBrowserDocument()) return;
+		const browserWindow = window;
+		const browserDocument = document;
+		const flusher = yield* OtlpExporter.Flusher;
+		const run = yield* FiberSet.makeRuntime();
+		const flush = () => {
+			run(flusher.flush);
+		};
+		const visibilityChanged = () => {
+			if (browserDocument.visibilityState === "hidden") flush();
+		};
+		yield* Effect.acquireRelease(Effect.sync(() => {
+			browserDocument.addEventListener("visibilitychange", visibilityChanged);
+			browserWindow.addEventListener("pagehide", flush);
+		}), () => Effect.sync(() => {
+			browserDocument.removeEventListener("visibilitychange", visibilityChanged);
+			browserWindow.removeEventListener("pagehide", flush);
+		}));
+	}));
+	const transport = Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, (client) => validated.producer === "browser" && hasBrowserDocument() ? browserExportClient(client) : client)).pipe(Layer.provide(FetchHttpClient.layer));
+	return browserLifecycle.pipe(Layer.provideMerge(Layer.mergeAll(tracing, logging, headerPolicy)), Layer.provide(OtlpSerialization.layerJson), Layer.provide(transport));
 };
 //#endregion
 export { ENGINEERING_CAPXUL_ENVS, makeEngineeringTelemetryLayer, makeLeakSafeEngineeringTracer, postHogOtlpEndpoints, traceHeaderFilter };

package/dist/index.d.mts

@@ -3181,12 +3181,12 @@ interface PostHogBrowserCapture {
  * The callback mutates and returns the supplied event, matching PostHog's
  * `before_send` contract while preserving the event's full structural type.
  */
-declare function sanitizePostHogBrowserEvent<T extends PostHogBrowserCapture | null>(event: T): T;
+declare function sanitizePostHogBrowserEvent<T extends PostHogBrowserCapture | null>(event: T, urlPolicy?: "path-only" | "diagnostic"): T;
 /**
  * Drop local events before transport. Sanitize and stamp every other browser
  * event with `capxul_env` and `producer: "browser"`.
  */
-declare function createCapxulBeforeSend(capxulEnv: CapxulEnv): <T extends PostHogBrowserCapture | null>(event: T) => T | null;
+declare function createCapxulBeforeSend(capxulEnv: CapxulEnv, urlPolicy?: "path-only" | "diagnostic"): <T extends PostHogBrowserCapture | null>(event: T) => T | null;
 type PostHogBeforeSend = ReturnType<typeof createCapxulBeforeSend>;
 /**
  * ADR-0016 posture, unchanged: capability-URL utility apps (approval links,
@@ -3227,7 +3227,7 @@ type PostHogBrowserOptions = PostHogUtilityAppOptions;
  *    funnel lies.
  *  - identify-driven person profiles (ADR-0020 A2 wires the calls at L1).
  *  - session replay in EVERY environment. Ordinary text and input values remain
- *    visible. Inputs with `autocomplete="one-time-code"` are masked. Network
+ *    visible. Password, OTP, and credential controls are masked. Network
  *    timing plus request/response headers and bodies are recorded, so a failed
  *    call shows its status and body in the replay. Canvas stays off. The
  *    recorder script loads from PostHog, so external dependency loading is on.
@@ -3298,17 +3298,14 @@ declare function utilityAppAnalytics(input: CapxulBrowserAnalyticsInput): PostHo
  * generic over the real request type and returns the same type it was given.
  */
 interface CapturedNetworkRequestLike {
+  readonly name?: string | undefined;
+  readonly url?: string | undefined;
   readonly requestHeaders?: Record<string, string> | undefined;
   readonly responseHeaders?: Record<string, string> | undefined;
   readonly requestBody?: unknown;
   readonly responseBody?: unknown;
 }
-/**
- * Replay keeps the request line, status, timing, headers, and bodies, so a
- * failed call carries its evidence. Credential headers and secret material
- * never leave the browser: bearer tokens, cookies, API keys, and the OTP a
- * user just typed are masked before the recording is sent.
- */
+/** Keep request evidence while masking credential values at the browser boundary. */
 declare function maskCapturedNetworkRequest<T extends CapturedNetworkRequestLike>(request: T): T;
 declare function productAppAnalytics(input: CapxulBrowserAnalyticsInput): PostHogProductAppOptions;
 type PostHogBrowserInitialize<Options, T> = (key: string, options: Options) => T;

package/dist/index.mjs

@@ -1,3 +1,4 @@
+import { i as redactUrlSecrets, n as isCredentialField, r as redactSecrets, t as CAPXUL_ERROR_CODES } from "./src-CWfRYsBI.mjs";
 import { Effect, Schema, SchemaGetter } from "effect";
 //#region ../errors/src/chain-cause.ts
 /**
@@ -35,39 +36,6 @@ const CHAIN_UPSTREAMS = [
 	"gateway"
 ];
 //#endregion
-//#region ../errors/src/errors.ts
-const CAPXUL_ERROR_CODES = [
-	"NOT_AUTHENTICATED",
-	"EMAIL_DELIVERY_FAILED",
-	"PROFILE_NOT_FOUND",
-	"SMART_ACCOUNT_MISSING",
-	"PLAYER_NOT_FOUND",
-	"ACCOUNT_NOT_FOUND",
-	"ACCOUNT_CLAIMED_BY_OTHER_SIGNER",
-	"PROVIDER_ERROR",
-	"CAPABILITY_UNAVAILABLE",
-	"INVALID_INPUT",
-	"ENV_MISSING",
-	"NOT_IMPLEMENTED",
-	"VERIFICATION_REQUIRED",
-	"INSUFFICIENT_BALANCE",
-	"INVALID_RECIPIENT",
-	"ROLE_PERMISSION_DENIED",
-	"TRANSACTION_FAILED",
-	"RATE_LIMITED",
-	"NETWORK_ERROR",
-	"UNKNOWN",
-	"OTP_EXPIRED",
-	"SIGNER_REJECTED",
-	"CANCELLED",
-	"WRONG_STATE",
-	"STALE_EPOCH",
-	"SUPERSEDED",
-	"WORK_DIED",
-	"ACTOR_STOPPED"
-];
-new Set(CAPXUL_ERROR_CODES);
-//#endregion
 //#region ../types/src/index.ts
 const EVM_ADDRESS_RE = /^0x[0-9a-f]{40}$/i;
 const BYTES32_RE = /^0x[0-9a-f]{64}$/i;
@@ -1775,22 +1743,24 @@ function redactTelemetryProps(name, props, options = {}) {
 * The callback mutates and returns the supplied event, matching PostHog's
 * `before_send` contract while preserving the event's full structural type.
 */
-function sanitizePostHogBrowserEvent(event) {
+function sanitizePostHogBrowserEvent(event, urlPolicy = "path-only") {
 	if (event === null) return event;
+	const transportToken = event.properties.token;
 	const seen = /* @__PURE__ */ new WeakSet();
-	sanitizePostHogBrowserValue(event.properties, seen);
-	if (event.$set !== void 0) sanitizePostHogBrowserValue(event.$set, seen);
-	if (event.$set_once !== void 0) sanitizePostHogBrowserValue(event.$set_once, seen);
+	sanitizePostHogBrowserValue(event.properties, seen, urlPolicy);
+	if (transportToken !== void 0) event.properties.token = transportToken;
+	if (event.$set !== void 0) sanitizePostHogBrowserValue(event.$set, seen, urlPolicy);
+	if (event.$set_once !== void 0) sanitizePostHogBrowserValue(event.$set_once, seen, urlPolicy);
 	return event;
 }
 /**
 * Drop local events before transport. Sanitize and stamp every other browser
 * event with `capxul_env` and `producer: "browser"`.
 */
-function createCapxulBeforeSend(capxulEnv) {
+function createCapxulBeforeSend(capxulEnv, urlPolicy = "path-only") {
 	return (event) => {
 		if (capxulEnv === "local") return null;
-		const sanitized = sanitizePostHogBrowserEvent(event);
+		const sanitized = sanitizePostHogBrowserEvent(event, urlPolicy);
 		if (sanitized === null) return sanitized;
 		sanitized.properties.capxul_env = capxulEnv;
 		sanitized.properties.producer ??= "browser";
@@ -1821,67 +1791,64 @@ function utilityAppAnalytics(input) {
 		before_send: createCapxulBeforeSend(input.capxulEnv)
 	};
 }
-const CREDENTIAL_HEADERS = /* @__PURE__ */ new Set([
-	"authorization",
-	"proxy-authorization",
-	"proxy-authenticate",
-	"www-authenticate",
-	"cookie",
-	"set-cookie",
-	"x-api-key",
-	"x-auth-token"
-]);
-/** Any JSON field whose name says "credential", however it is spelled. */
-const CREDENTIAL_FIELD_NAME = /(?:otp|code|pass(?:word|wd|phrase)?|token|secret|credential|api[_-]?key|private[_-]?key|authorization|cookie|session)/iu;
-/** Secret material in captured text: bearer tokens, JWTs, keys, and credential fields. */
-const NETWORK_TEXT_MASKS = [
-	[/\bBearer\s+[^\s,;"]+/giu, "Bearer [REDACTED]"],
-	[/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]"],
-	[/\b0x[a-fA-F0-9]{40,}\b/gu, "[REDACTED]"],
-	[/\b([A-Za-z_][A-Za-z0-9_.-]*=)[^&\s"]+/gu, "$1[REDACTED]"]
-];
-/** `"name": "value"` JSON pairs; the name decides whether the value is masked. */
-const JSON_STRING_FIELD = /("([^"\\]*)"\s*:\s*")((?:[^"\\]|\\.)*)(")/gu;
-const QUERY_PAIR = /\b([A-Za-z_][A-Za-z0-9_.-]*=)[^&\s"]+/gu;
-function maskNetworkText(text) {
-	return NETWORK_TEXT_MASKS.slice(0, 3).reduce((current, [pattern, replacement]) => current.replace(pattern, replacement), text).replace(JSON_STRING_FIELD, (whole, open, name, _value, close) => CREDENTIAL_FIELD_NAME.test(name) ? `${open}[REDACTED]${close}` : whole).replace(QUERY_PAIR, (whole, name) => CREDENTIAL_FIELD_NAME.test(name) ? `${name}[REDACTED]` : whole);
+/** In unstructured bodies, preserve text around explicitly named credentials. */
+const NETWORK_FIELD = /((?:"?)([A-Za-z_][A-Za-z0-9_.-]*)(?:"?)\s*[:=]\s*)("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s,;&}]+)/gu;
+function maskNetworkText(text, context) {
+	return redactSecrets(text).replace(NETWORK_FIELD, (whole, prefix, name, value) => {
+		if (!isCredentialField(name, context)) return whole;
+		const quote = value.startsWith("\"") ? "\"" : value.startsWith("'") ? "'" : "";
+		return `${prefix}${quote}[REDACTED]${quote}`;
+	});
 }
 function maskNetworkHeaders(headers) {
 	if (headers === void 0) return void 0;
 	const masked = {};
-	for (const [name, value] of Object.entries(headers)) masked[name] = CREDENTIAL_HEADERS.has(name.toLowerCase()) ? "[REDACTED]" : maskNetworkText(value);
+	for (const [name, value] of Object.entries(headers)) masked[name] = isCredentialField(name, "header") ? "[REDACTED]" : /^(?:location|content-location|referer)$/iu.test(name) ? redactUrlSecrets(value) : maskNetworkText(value);
 	return masked;
 }
-/** Mask by KEY at every depth: a credential-named field loses its whole value. */
-function maskJsonValue(value, depth = 0) {
-	if (typeof value === "string") return maskNetworkText(value);
+function maskJsonValue(value, depth = 0, context) {
+	if (typeof value === "function" || typeof value === "symbol") return "[UNREADABLE]";
+	if (typeof value === "string") return maskNetworkText(value, context);
 	if (typeof value !== "object" || value === null) return value;
 	if (depth >= 16) return "[REDACTED]";
-	if (Array.isArray(value)) return value.map((item) => maskJsonValue(item, depth + 1));
-	const masked = {};
-	for (const [key, nested] of Object.entries(value)) masked[key] = CREDENTIAL_FIELD_NAME.test(key) ? "[REDACTED]" : maskJsonValue(nested, depth + 1);
+	if (Array.isArray(value)) return value.map((item) => maskJsonValue(item, depth + 1, context));
+	const masked = Object.create(null);
+	for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value))) {
+		if (!descriptor.enumerable) continue;
+		masked[key] = isCredentialField(key, context) ? "[REDACTED]" : !("value" in descriptor) ? "[UNREADABLE]" : typeof descriptor.value === "string" && isPostHogUrlProperty(key) ? redactUrlSecrets(descriptor.value) : maskJsonValue(descriptor.value, depth + 1, context);
+	}
 	return masked;
 }
-function maskNetworkBody(body) {
-	if (typeof body !== "string") return body;
+function maskNetworkBody(body, context) {
 	try {
-		const parsed = JSON.parse(body);
-		if (typeof parsed === "object" && parsed !== null) return JSON.stringify(maskJsonValue(parsed));
-	} catch {}
-	return maskNetworkText(body);
+		if (typeof body !== "string") return maskJsonValue(body, 0, context);
+		let parsed;
+		try {
+			parsed = JSON.parse(body);
+		} catch {
+			if (/^[^=&\s]+=[\s\S]*$/u.test(body)) return new URLSearchParams(Array.from(new URLSearchParams(body), ([name, value]) => [name, isCredentialField(name, context) ? "[REDACTED]" : maskNetworkText(value)])).toString();
+			return maskNetworkText(body, context);
+		}
+		return JSON.stringify(maskJsonValue(parsed, 0, context));
+	} catch {
+		return "[UNREADABLE]";
+	}
 }
-/**
-* Replay keeps the request line, status, timing, headers, and bodies, so a
-* failed call carries its evidence. Credential headers and secret material
-* never leave the browser: bearer tokens, cookies, API keys, and the OTP a
-* user just typed are masked before the recording is sent.
-*/
+/** Keep request evidence while masking credential values at the browser boundary. */
 function maskCapturedNetworkRequest(request) {
+	const requestUrl = request.name ?? request.url ?? "";
+	let context;
+	try {
+		const path = new URL(requestUrl, "https://capxul.invalid").pathname;
+		if (/\/(?:auth|oauth|sign-in|signin|login|verify-otp|verify-email)(?:\/|$)/iu.test(path)) context = "authentication";
+	} catch {}
 	return {
 		...request,
+		...request.name === void 0 ? {} : { name: redactUrlSecrets(request.name) },
+		...request.url === void 0 ? {} : { url: redactUrlSecrets(request.url) },
 		requestHeaders: maskNetworkHeaders(request.requestHeaders),
 		responseHeaders: maskNetworkHeaders(request.responseHeaders),
-		requestBody: maskNetworkBody(request.requestBody),
+		requestBody: maskNetworkBody(request.requestBody, context),
 		responseBody: maskNetworkBody(request.responseBody)
 	};
 }
@@ -1911,13 +1878,20 @@ function productAppAnalytics(input) {
 		save_referrer: false,
 		session_recording: {
 			maskAllInputs: true,
-			maskInputFn: (text, element) => element?.getAttribute("autocomplete")?.toLowerCase().split(/\s+/u).includes("one-time-code") ? "*".repeat(text.length) : text,
+			maskInputFn: (text, element) => {
+				const autocomplete = element?.getAttribute("autocomplete")?.toLowerCase().split(/\s+/u) ?? [];
+				return element?.getAttribute("type")?.toLowerCase() === "password" || autocomplete.some((value) => [
+					"one-time-code",
+					"current-password",
+					"new-password"
+				].includes(value)) || isCredentialField(element?.getAttribute("name") ?? "") || isCredentialField(element?.getAttribute("id") ?? "") ? "*".repeat(text.length) : maskNetworkText(text);
+			},
 			captureCanvas: { recordCanvas: false },
 			recordHeaders: true,
 			recordBody: true,
 			maskCapturedNetworkRequestFn: maskCapturedNetworkRequest
 		},
-		before_send: createCapxulBeforeSend(input.capxulEnv)
+		before_send: createCapxulBeforeSend(input.capxulEnv, "diagnostic")
 	};
 }
 /**
@@ -1974,11 +1948,15 @@ function createPostHogBrowserPageviewTracker(client) {
 		} catch {}
 	};
 }
-function sanitizePostHogBrowserValue(value, seen) {
+function sanitizePostHogBrowserValue(value, seen, urlPolicy) {
 	if (typeof value !== "object" || value === null || seen.has(value)) return;
 	seen.add(value);
 	if (Array.isArray(value)) {
-		for (const item of value) sanitizePostHogBrowserValue(item, seen);
+		for (let index = 0; index < value.length; index++) {
+			const item = value[index];
+			if (typeof item === "string") value[index] = maskNetworkText(item);
+			else sanitizePostHogBrowserValue(item, seen, urlPolicy);
+		}
 		return;
 	}
 	const properties = value;
@@ -1987,11 +1965,15 @@ function sanitizePostHogBrowserValue(value, seen) {
 			delete properties[key];
 			continue;
 		}
-		if (typeof nestedValue === "string" && isPostHogUrlProperty(key)) {
-			properties[key] = stripUrlQueryAndFragment(nestedValue);
+		if (isCredentialField(key)) {
+			properties[key] = "[REDACTED]";
+			continue;
+		}
+		if (typeof nestedValue === "string") {
+			properties[key] = isPostHogUrlProperty(key) ? urlPolicy === "path-only" ? stripUrlQueryAndFragment(nestedValue) : redactUrlSecrets(nestedValue) : maskNetworkText(nestedValue);
 			continue;
 		}
-		sanitizePostHogBrowserValue(nestedValue, seen);
+		sanitizePostHogBrowserValue(nestedValue, seen, urlPolicy);
 	}
 }
 const POSTHOG_QUERY_DERIVED_PROPERTY_NAMES = [

package/dist/src-CWfRYsBI.mjs

@@ -0,0 +1,302 @@
+//#region ../errors/src/secret-material.ts
+const CREDENTIAL_FIELDS = /* @__PURE__ */ new Set([
+	"password",
+	"passwd",
+	"pwd",
+	"pass",
+	"passphrase",
+	"currentpassword",
+	"newpassword",
+	"confirmpassword",
+	"passwordconfirmation",
+	"passwordhash",
+	"hashedpassword",
+	"pin",
+	"privatekey",
+	"walletprivatekey",
+	"secretkey",
+	"signingkey",
+	"signingsecret",
+	"seed",
+	"seedphrase",
+	"mnemonic",
+	"recoveryphrase",
+	"recovery",
+	"recoverycode",
+	"recoverycodes",
+	"keyshare",
+	"signingmaterial",
+	"recoverymaterial",
+	"privatekeybytes",
+	"signingprivatekey",
+	"encryptionkey",
+	"decryptionkey",
+	"authtoken",
+	"apitoken",
+	"bearertoken",
+	"oauthtoken",
+	"csrftoken",
+	"clientassertion",
+	"token",
+	"accesstoken",
+	"refreshtoken",
+	"idtoken",
+	"sessiontoken",
+	"session",
+	"sessionkey",
+	"sessionsecret",
+	"authsessionid",
+	"sessioncredential",
+	"sessioncredentials",
+	"sessioncookie",
+	"auth",
+	"authentication",
+	"authorization",
+	"proxyauthorization",
+	"cookie",
+	"cookies",
+	"setcookie",
+	"apikey",
+	"xapikey",
+	"xauthtoken",
+	"clientsecret",
+	"secret",
+	"secrets",
+	"credential",
+	"credentials",
+	"signature",
+	"otp",
+	"otpcode",
+	"totpsecret",
+	"onetimecode",
+	"onetimepassword",
+	"verificationcode",
+	"authcode",
+	"authorizationcode",
+	"oauthcode",
+	"codeverifier"
+]);
+/** Match credential fields by meaning, without hiding token addresses or replay IDs. */
+function isCredentialField(name, context) {
+	const normalized = name.toLowerCase().replace(/[^a-z0-9]/gu, "");
+	return CREDENTIAL_FIELDS.has(normalized) || /(?:password(?:hash)?|passwd|passphrase|privatekey|signingkey|apikey|clientsecret|accesstoken|refreshtoken|sessiontoken)$/u.test(normalized) || context === "authentication" && (normalized === "code" || normalized === "sessionid") || context === "header" && /(?:token|secret|apikey|privatekey|signingkey|password|authorization|cookie|session)$/u.test(normalized);
+}
+function decodeUrlComponent(text) {
+	try {
+		return decodeURIComponent(text);
+	} catch {
+		return text;
+	}
+}
+/** Preserve URL diagnostics while removing credentials from their declared components. */
+function redactUrlSecrets(value, source) {
+	try {
+		const absolute = /^[a-z][a-z0-9+.-]*:/iu.test(value);
+		const protocolRelative = value.startsWith("//");
+		const url = new URL(value, "https://redaction.invalid");
+		if (url.protocol !== "https:" && url.protocol !== "http:") return maskText(value);
+		let changed = url.username.length > 0 || url.password.length > 0;
+		const maskParams = (params) => new URLSearchParams(Array.from(params, ([name, entry]) => {
+			const safeName = maskText(name);
+			const safeEntry = isCredentialField(name) || /^(?:code|draft|__posthog)$/iu.test(name) ? "[REDACTED]" : maskText(entry);
+			changed ||= safeName !== name || safeEntry !== entry;
+			return [safeName, safeEntry];
+		})).toString();
+		const provider = source !== void 0 || /(?:^|\.)(?:alchemy\.com|alchemyapi\.io|infura\.io)$/iu.test(url.hostname);
+		const segments = (absolute || protocolRelative ? url.pathname : value.split(/[?#]/u)[0] ?? "").split("/");
+		const path = segments.map((segment, index) => {
+			const decoded = decodeUrlComponent(segment);
+			const masked = provider && /^v[23]$/u.test(decodeUrlComponent(segments[index - 1] ?? "")) && decoded.length > 0 ? "[REDACTED]" : maskText(decoded);
+			changed ||= masked !== decoded;
+			return masked === decoded ? segment : encodeURIComponent(masked);
+		}).join("/");
+		const query = maskParams(url.searchParams);
+		const fragment = url.hash.slice(1);
+		const decodedFragment = decodeUrlComponent(fragment);
+		const maskedFragment = maskText(decodedFragment);
+		changed ||= maskedFragment !== decodedFragment;
+		const fragmentQuery = fragment.indexOf("?");
+		const fragmentPath = fragment.slice(0, fragmentQuery);
+		const maskedFragmentPath = maskText(decodeUrlComponent(fragmentPath));
+		changed ||= maskedFragmentPath !== decodeUrlComponent(fragmentPath);
+		const hash = fragmentQuery >= 0 ? `${maskedFragmentPath === decodeUrlComponent(fragmentPath) ? fragmentPath : encodeURIComponent(maskedFragmentPath)}?${maskParams(new URLSearchParams(fragment.slice(fragmentQuery + 1)))}` : fragment.includes("=") ? maskParams(new URLSearchParams(fragment)) : maskedFragment === decodedFragment ? fragment : encodeURIComponent(maskedFragment);
+		const origin = absolute ? url.origin : protocolRelative ? `//${url.host}` : "";
+		if (!changed) return value;
+		return `${origin}${path}${query ? `?${query}` : ""}${hash ? `#${hash}` : ""}`;
+	} catch {
+		return maskText(value.replace(/(https?:\/\/)[^/\s@]+@/giu, "$1[REDACTED]@").replace(/([?&#])([^=&#]+)=([^&#]*)/gu, (whole, separator, name) => isCredentialField(decodeUrlComponent(name)) || /^(?:code|draft|__posthog)$/iu.test(decodeUrlComponent(name)) ? `${separator}${name}=[REDACTED]` : whole));
+	}
+}
+const JSON_FIELD = /("(?:[^"\\]|\\.)*")(\s*:\s*)("(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null)/gu;
+const PROSE_FIELD = /(?=(\b([A-Za-z][A-Za-z0-9_-]*(?:[ \t]+[A-Za-z][A-Za-z0-9_-]*){0,3})\s*[:=]\s*((?:Bearer|Basic)[ \t]+[^\s,;"']+|"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s,;&"']+)))/gu;
+const EMBEDDED_URL = /(https?:\/\/[^\s"<>]*)/giu;
+function isSecretLabel(name) {
+	return isCredentialField(name) || /^request[ _-]?body$/iu.test(name);
+}
+const JSON_ENCODING_MAX = 8;
+const JSON_NESTING_MAX = 64;
+const JSON_KEY = /("(?:[^"\\]|\\.)*")\s*:/gu;
+const JSON_CONTAINER_START = /(?:\{\s*["}]|\[\s*[[\]{}"0-9tfn-])/uy;
+function hasSecretJsonKey(value) {
+	for (const match of value.matchAll(JSON_KEY)) try {
+		if (match[1] !== void 0 && isSecretLabel(JSON.parse(match[1]))) return true;
+	} catch {}
+	return false;
+}
+/** Project a complete fragment once. Never retry all of its nested substrings. */
+function projectJsonFragment(value, encodingDepth, overDepth) {
+	if (overDepth || encodingDepth >= JSON_ENCODING_MAX) return "[REDACTED]";
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		return hasSecretJsonKey(value) ? "[REDACTED]" : value;
+	}
+	try {
+		let changed = false;
+		const masked = JSON.stringify(parsed, (name, nested) => {
+			if (isSecretLabel(name)) {
+				changed ||= nested !== "[REDACTED]";
+				return "[REDACTED]";
+			}
+			if (typeof nested === "string") {
+				const projected = maskJsonFragments(nested, encodingDepth + 1);
+				changed ||= projected !== nested;
+				return projected;
+			}
+			return nested;
+		});
+		return changed ? masked : value;
+	} catch {
+		return "[REDACTED]";
+	}
+}
+/** Scan balanced object/array fragments once, respecting JSON quotes and escapes. */
+function maskJsonFragments(value, encodingDepth = 0) {
+	if (value.trimStart().startsWith("\"")) try {
+		const decoded = JSON.parse(value);
+		if (typeof decoded === "string") {
+			if (encodingDepth >= JSON_ENCODING_MAX) return "\"[REDACTED]\"";
+			const masked = maskJsonFragments(decoded, encodingDepth + 1);
+			return masked === decoded ? value : JSON.stringify(masked);
+		}
+	} catch {}
+	let output = "";
+	let cursor = 0;
+	let start = -1;
+	let depth = 0;
+	let overDepth = false;
+	let quoted = false;
+	let escaped = false;
+	for (let index = 0; index < value.length; index++) {
+		const character = value[index];
+		if (start < 0) {
+			JSON_CONTAINER_START.lastIndex = index;
+			if (!JSON_CONTAINER_START.test(value)) continue;
+			start = index;
+			depth = 1;
+			overDepth = false;
+			continue;
+		}
+		if (quoted) {
+			if (escaped) escaped = false;
+			else if (character === "\\") escaped = true;
+			else if (character === "\"") quoted = false;
+			continue;
+		}
+		if (character === "\"") quoted = true;
+		else if (character === "{" || character === "[") {
+			depth++;
+			overDepth ||= depth > JSON_NESTING_MAX;
+		} else if (character === "}" || character === "]") {
+			depth--;
+			if (depth !== 0) continue;
+			output += value.slice(cursor, start) + projectJsonFragment(value.slice(start, index + 1), encodingDepth, overDepth);
+			cursor = index + 1;
+			start = -1;
+		}
+	}
+	if (start >= 0) {
+		const fragment = value.slice(start);
+		output += value.slice(cursor, start) + (overDepth || hasSecretJsonKey(fragment) ? "[REDACTED]" : fragment);
+		cursor = value.length;
+	}
+	return output + value.slice(cursor);
+}
+function maskLabelledText(value) {
+	const jsonMasked = maskJsonFragments(value).replace(JSON_FIELD, (whole, quotedName, separator) => {
+		try {
+			return isSecretLabel(JSON.parse(quotedName)) ? `${quotedName}${separator}"[REDACTED]"` : whole;
+		} catch {
+			return whole;
+		}
+	});
+	let output = "";
+	let cursor = 0;
+	for (const match of jsonMasked.matchAll(PROSE_FIELD)) {
+		const [, whole, label, entry] = match;
+		if (whole === void 0 || label === void 0 || entry === void 0 || match.index < cursor || /^Bearer[ \t]+/iu.test(entry)) continue;
+		const words = label.split(/[ \t]+/u);
+		for (let index = 0; index < words.length; index++) {
+			const name = words.slice(index).join(" ");
+			if (isSecretLabel(name)) {
+				const prefix = words.slice(0, index).join(" ");
+				output += jsonMasked.slice(cursor, match.index) + `${prefix ? `${prefix} ` : ""}${name}=[REDACTED]`;
+				cursor = match.index + whole.length;
+				break;
+			}
+		}
+	}
+	return output + jsonMasked.slice(cursor);
+}
+const TOKEN_MASKS = [
+	[/\bBearer\s+(?!(?:realm|error|error_description|scope|authorization_uri|resource|claims)\s*=)[^\s,;"']+/giu, "Bearer [REDACTED]"],
+	[/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]"],
+	[/(^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?=$|[^a-fA-F0-9])/gu, "$1[REDACTED]"],
+	[/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu, "[REDACTED]"]
+];
+/** URL components and malformed URLs use this non-recursive masking layer. */
+function maskText(value) {
+	let text = maskLabelledText(value);
+	for (const [pattern, replacement] of TOKEN_MASKS) text = text.replace(pattern, replacement);
+	return text;
+}
+/** Mask credential fields and embedded URLs while preserving surrounding evidence. */
+function redactSecrets(value, source) {
+	return maskLabelledText(value).split(EMBEDDED_URL).map((part, index) => index % 2 === 1 ? redactUrlSecrets(part, source).replaceAll("%5BREDACTED%5D", "[REDACTED]") : maskText(part)).join("");
+}
+//#endregion
+//#region ../errors/src/errors.ts
+const CAPXUL_ERROR_CODES = [
+	"NOT_AUTHENTICATED",
+	"EMAIL_DELIVERY_FAILED",
+	"PROFILE_NOT_FOUND",
+	"SMART_ACCOUNT_MISSING",
+	"PLAYER_NOT_FOUND",
+	"ACCOUNT_NOT_FOUND",
+	"ACCOUNT_CLAIMED_BY_OTHER_SIGNER",
+	"PROVIDER_ERROR",
+	"CAPABILITY_UNAVAILABLE",
+	"INVALID_INPUT",
+	"ENV_MISSING",
+	"NOT_IMPLEMENTED",
+	"VERIFICATION_REQUIRED",
+	"INSUFFICIENT_BALANCE",
+	"INVALID_RECIPIENT",
+	"ROLE_PERMISSION_DENIED",
+	"TRANSACTION_FAILED",
+	"RATE_LIMITED",
+	"NETWORK_ERROR",
+	"UNKNOWN",
+	"OTP_EXPIRED",
+	"SIGNER_REJECTED",
+	"CANCELLED",
+	"WRONG_STATE",
+	"STALE_EPOCH",
+	"SUPERSEDED",
+	"WORK_DIED",
+	"ACTOR_STOPPED"
+];
+new Set(CAPXUL_ERROR_CODES);
+//#endregion
+export { redactUrlSecrets as i, isCredentialField as n, redactSecrets as r, CAPXUL_ERROR_CODES as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/observability",
-  "version": "4.1.4",
+  "version": "4.2.0-rc.1",
   "private": false,
   "repository": {
     "type": "git",
@@ -37,8 +37,8 @@
     "vite": "npm:@voidzero-dev/vite-plus-core@0.3.0",
     "vite-plus": "0.3.0",
     "vitest": "4.1.11",
-    "@capxul/errors": "0.3.0",
     "@capxul/types": "0.3.0",
+    "@capxul/errors": "0.3.0",
     "@capxul/typescript-config": "0.0.0"
   },
   "scripts": {