@foam-ai/node 0.1.0-alpha.10 → 0.1.0-alpha.12

package/README.md

@@ -181,7 +181,9 @@ init({
 ```
 
 `beforeSend` can edit or drop spans and logs before Foam exports them. Return
-the event to send it or `null` to drop it.
+the event to send it or `null` to drop it. Span events carry `name`,
+`attributes`, `events` (span events, e.g. recorded exceptions), and `links`;
+log events carry `body`, `severityText`, and `attributes`.
 
 ```js
 init({
@@ -259,10 +261,10 @@ const loggerProvider = new LoggerProvider({
 logs.setGlobalLoggerProvider(loggerProvider);
 ```
 
-Both ingest helpers accept the same `redact` and `beforeSend` options as
-`init()`.
+All ingest helpers accept the same `redact` option as `init()`; the span and
+log helpers also accept `beforeSend`.
 
-### `createFoamIngestMetricReader(name, environment, token)`
+### `createFoamIngestMetricReader(name, environment, token, options?)`
 
 The helper returns a metric reader but does not attach it to the application's
 provider. Include it in the `readers` option when constructing `MeterProvider`.
@@ -572,11 +574,16 @@ export wherever `getState().signals.traces` points.
 ## Redaction
 
 Foam always masks common credentials in captured request and response data,
-URLs, and exported span and log fields. Add application-specific keys with the
-`redact` option shown under `init(options)`.
+URLs, and exported span and log fields. The built-in floor matches both exact
+well-known names and any key containing a sensitive term (`legacy_api_key_2`,
+`stripeToken`), so credential-bearing keys do not need to be enumerated. Add
+application-specific keys with the `redact` option shown under `init(options)`;
+customer keys match exactly after normalization.
 
-Redaction applies to Foam's exports, including ingest helpers. It does not
-modify telemetry sent through other exporters.
+Redaction applies to everything Foam exports — span, span event, and link
+attributes, log bodies and attributes, metric data-point attributes, and
+resource attributes — including the ingest helpers. It does not modify
+telemetry sent through other exporters.
 
 ## Loggers
 
@@ -639,6 +646,85 @@ The official OpenTelemetry JavaScript SDK has no in-process Profiles provider, p
 - [OpenTelemetry Profiles public alpha announcement](https://opentelemetry.io/blog/2026/profiles-alpha/)
 - [OpenTelemetry eBPF profiler](https://github.com/open-telemetry/opentelemetry-ebpf-profiler)
 
+## TODO(pcga11): Expanded data capture (http2, gRPC, DB results, messaging)
+
+Extension points Foam is not using yet, ordered by how much new data they
+unlock. All payload extraction flows through the same redaction and size
+caps as HTTP network capture.
+
+### Database results — biggest win, zero patching
+
+`responseHook` hands Foam the raw driver result (in memory, no extra query)
+before the span ends. Each package has its own payload shape — do not
+assume a shared contract: `pg` passes `{ data }`, `mysql2`
+`{ queryResults }`, `mongoose` `{ response }`, `mongodb` the command
+response, `cassandra-driver` only the first result page, and
+`ioredis`/`redis` (v4+) use positional `(cmdName, cmdArgs, response)`
+args. Also `requestHook` (pg, ioredis, oracledb) for full query/args, and
+`maskStatementHook` (mysql2) to wire SQL text into Foam redaction. No
+hooks: `mysql` v1, `tedious`, `memcached` — spans only. Ship as opt-in:
+results are the most PII-dense payload in the system.
+`enhancedDatabaseReporting` (adds bound parameter values) must likewise
+stay opt-in — redaction cannot key-match values inside SQL text.
+
+### http2 + gRPC — currently fully dark
+
+Node ships `http2.client.stream.*` / `http2.server.stream.*` lifecycle
+channels since 24.1 (backported to 22.x), and the request-body channels
+`bodyChunkSent` / `bodySent` since 24.12.0 / 22.22.1 — pin those floors in
+`support.ts`, gated on the Node version (core emits these, unlike undici's
+own channels). The adapter mirrors `src/network-capture/undici.ts` but the
+payloads differ: Node publishes `{ stream, writev, data, encoding }` for
+`bodyChunkSent` and `{ stream }` for `bodySent`, vs undici's
+`{ request, chunk }` — map fields explicitly. No OTel instrumentation
+exists for http2, so Foam creates the spans too. Response bodies have no
+channel and the exposed `ClientHttp2Stream` is live, not replayable:
+collect passively (wrap `push()` as `http.ts` does) without reading the
+stream or switching it into flowing mode, or leave response capture out.
+For gRPC, `instrumentation-grpc` gives spans but zero payload hooks
+(only `metadataToSpanAttributes` — enable it). The http2 body chunks carry
+gRPC framing, not bare protobuf: reassemble the 1-byte compression flag +
+4-byte big-endian length prefix per message, decompressing flagged
+messages, before any protobuf decode — or skip framing entirely with a
+custom patch of `@grpc/grpc-js` serialization.
+
+### Messaging and cloud payloads — hooks receive the actual message
+
+- `kafkajs` `producerHook`/`consumerHook` receive `{ topic, message }`
+  (value, key, headers); `amqplib` `publishHook`/`consumeHook`
+  (+confirm/end variants) receive the message `content` plus
+  routing/options metadata — shapes differ per hook.
+- `socket.io` `emitHook`/`onHook`: event payloads (covers the socket.io
+  slice of WebSocket traffic).
+- `aws-sdk` `preRequestHook`/`responseHook`/`exceptionHook` (the latter
+  gets `(span, requestInfo, err)`): normalized request/response for every
+  AWS call. SDK v3 only.
+
+### Crash and shutdown capture — data we currently lose
+
+Errors outside any span (timer callbacks, unhandled rejections, startup)
+are invisible, and `beforeExit` — Foam's only lifecycle hook — does not
+fire on crashes or signals, so the batch holding the spans that explain a
+crash dies with the process, and every SIGTERM (each deploy) drops the
+final batch window. Use `uncaughtExceptionMonitor` (never plain
+`uncaughtException`, which suppresses the default crash) — but note an
+async flush started there is abandoned when the process terminates, so
+crash delivery needs a synchronous durable handoff (sync write to disk, or
+a helper process that ships it) rather than relying on the async exporter.
+SIGTERM/SIGINT get flush-then-resignal handlers with a bounded flush
+timeout that never swallows the signal or changes the exit code. `warning`
+events ship as logs.
+
+### Smaller / later
+
+- `logHook` (bunyan/pino/winston), `graphql` `responseHook`,
+  `express`/`koa`/`restify` `requestHook`: enrichment, little new data.
+- Channels: `worker_threads` (detect uninstrumented workers), 24+ native
+  `console.*` (could replace patch-based console capture),
+  `tracing:module.*` (library-version detection), `child_process`.
+- No hook surface at all: raw `ws` frames (custom patch, frame data model)
+  and Prisma (Rust engine; needs app-enabled Prisma OTel tracing).
+
 ## TODO(pcga11): Anthropic instrumentation
 
 There is no released official OpenTelemetry JavaScript instrumentation for the Anthropic SDK yet, but one is actively in progress in js-contrib, based on the OpenInference donation from Arize. Once `@opentelemetry/instrumentation-anthropic` is released (and picked up by `auto-instrumentations-node`), bundle it here like the OpenAI and aws-sdk ones. Until then, Anthropic coverage is handled case by case with the FDE (see FDE.md). Track upstream progress:

package/dist/before-send.d.ts

@@ -1,7 +1,18 @@
+export interface BeforeSendSpanEventEntry {
+    name: string;
+    attributes?: Record<string, unknown>;
+    time?: unknown;
+}
+export interface BeforeSendSpanLink {
+    context: Record<string, unknown>;
+    attributes?: Record<string, unknown>;
+}
 interface BeforeSendSpanEvent {
     readonly type: "span";
     name: string;
     attributes: Record<string, unknown>;
+    events: BeforeSendSpanEventEntry[];
+    links: BeforeSendSpanLink[];
 }
 interface BeforeSendLogEvent {
     readonly type: "log";

package/dist/before-send.js

@@ -17,8 +17,13 @@ function isEvent(value, expectedType) {
     if (!isRecord(value) || value.type !== expectedType || !isRecord(value.attributes)) {
         return false;
     }
-    if (expectedType === "span")
-        return typeof value.name === "string";
+    if (expectedType === "span") {
+        return (typeof value.name === "string" &&
+            Array.isArray(value.events) &&
+            value.events.every((entry) => isRecord(entry) && typeof entry.name === "string") &&
+            Array.isArray(value.links) &&
+            value.links.every((entry) => isRecord(entry) && isRecord(entry.context)));
+    }
     return value.severityText === undefined || typeof value.severityText === "string";
 }
 function invokeBeforeSend(hook, event) {

package/dist/constants.d.ts

@@ -4,7 +4,7 @@ export declare const FOAM_INGEST_HOST: string;
 export declare const ATTR_FOAM_INGEST_HOST = "foam.ingest.host";
 export declare const FOAM_IDENTIFIER_NAME = "[foam-otel]";
 export declare const FOAM_DISTRO_NAME = "@foam-ai/node";
-export declare const FOAM_DISTRO_VERSION = "0.1.0-alpha.5";
+export declare const FOAM_DISTRO_VERSION = "0.1.0-alpha.12";
 export declare const FOAM_OTLP_TRACES_PATH = "/v1/traces";
 export declare const FOAM_OTLP_LOGS_PATH = "/v1/logs";
 export declare const FOAM_OTLP_METRICS_PATH = "/v1/metrics";

package/dist/constants.js

@@ -7,7 +7,7 @@ exports.FOAM_INGEST_HOST = new URL(exports.FOAM_ENDPOINT).hostname;
 exports.ATTR_FOAM_INGEST_HOST = "foam.ingest.host";
 exports.FOAM_IDENTIFIER_NAME = "[foam-otel]";
 exports.FOAM_DISTRO_NAME = "@foam-ai/node";
-exports.FOAM_DISTRO_VERSION = "0.1.0-alpha.5";
+exports.FOAM_DISTRO_VERSION = "0.1.0-alpha.12";
 exports.FOAM_OTLP_TRACES_PATH = "/v1/traces";
 exports.FOAM_OTLP_LOGS_PATH = "/v1/logs";
 exports.FOAM_OTLP_METRICS_PATH = "/v1/metrics";

package/dist/exporters.d.ts

@@ -27,7 +27,8 @@ export declare class FoamLogExporter extends OTLPLogExporter {
 }
 export declare class FoamMetricExporter extends OTLPMetricExporter {
     private readonly stamp?;
-    constructor(token: string, stamp?: Stamp);
+    private readonly options;
+    constructor(token: string, stamp?: Stamp, options?: FoamExporterOptions);
     export(resourceMetrics: ResourceMetrics, callback: (result: ExportResult) => void): void;
 }
 export {};

package/dist/exporters.js

@@ -13,7 +13,15 @@ const redaction_js_1 = require("./redaction.js");
 function redactionConfig(options) {
     return options.redaction ?? (0, redaction_js_1.getActiveRedactionConfig)();
 }
-function copySpan(span, name, attributes, events, links, overlay) {
+// Snapshotting attributes here is safe: every SDK processor (batch/simple
+// span, batch log, periodic metric reader) awaits the resource's
+// waitForAsyncAttributes() before calling the exporter, so detector
+// promises are already resolved.
+function redactedResource(resource, overlay, config) {
+    const merged = overlay ? resource.merge(overlay) : resource;
+    return (0, resources_1.resourceFromAttributes)((0, redaction_js_1.redactAttributesCopy)(merged.attributes, config), { schemaUrl: merged.schemaUrl });
+}
+function copySpan(span, name, attributes, events, links, resource) {
     return {
         name,
         kind: span.kind,
@@ -27,7 +35,7 @@ function copySpan(span, name, attributes, events, links, overlay) {
         events,
         duration: span.duration,
         ended: span.ended,
-        resource: overlay ? span.resource.merge(overlay) : span.resource,
+        resource,
         instrumentationScope: span.instrumentationScope,
         droppedAttributesCount: span.droppedAttributesCount,
         droppedEventsCount: span.droppedEventsCount,
@@ -52,33 +60,44 @@ class FoamTraceExporter extends exporter_trace_otlp_http_1.OTLPTraceExporter {
         for (const span of spans) {
             let name = span.name;
             let sourceAttributes = span.attributes;
+            let sourceEvents = span.events ?? [];
+            let sourceLinks = span.links ?? [];
             if (this.options.beforeSend) {
                 const result = (0, before_send_js_1.invokeBeforeSend)(this.options.beforeSend, {
                     type: "span",
                     name,
                     attributes: sourceAttributes,
+                    events: sourceEvents,
+                    links: sourceLinks,
                 });
                 if (result === null)
                     continue;
                 if (result?.type === "span") {
                     name = result.name;
                     sourceAttributes = result.attributes;
+                    // Hook-added events may omit time; default it to the span start so
+                    // OTLP serialization stays valid.
+                    sourceEvents = result.events.map((entry) => ({
+                        time: span.startTime,
+                        ...entry,
+                    }));
+                    sourceLinks = result.links;
                 }
             }
             const attributes = (0, redaction_js_1.redactAttributesCopy)(sourceAttributes, config);
-            const events = (span.events ?? []).map((event) => event.attributes
+            const events = sourceEvents.map((event) => event.attributes
                 ? {
                     ...event,
                     attributes: (0, redaction_js_1.redactAttributesCopy)(event.attributes, config),
                 }
                 : event);
-            const links = (span.links ?? []).map((link) => link.attributes
+            const links = sourceLinks.map((link) => link.attributes
                 ? {
                     ...link,
                     attributes: (0, redaction_js_1.redactAttributesCopy)(link.attributes, config),
                 }
                 : link);
-            output.push(copySpan(span, name, attributes, events, links, overlay));
+            output.push(copySpan(span, name, attributes, events, links, redactedResource(span.resource, overlay, config)));
         }
         if (output.length === 0) {
             callback({ code: core_1.ExportResultCode.SUCCESS });
@@ -88,7 +107,7 @@ class FoamTraceExporter extends exporter_trace_otlp_http_1.OTLPTraceExporter {
     }
 }
 exports.FoamTraceExporter = FoamTraceExporter;
-function copyLog(record, body, severityText, attributes, overlay) {
+function copyLog(record, body, severityText, attributes, resource) {
     return {
         hrTime: record.hrTime,
         hrTimeObserved: record.hrTimeObserved,
@@ -97,7 +116,7 @@ function copyLog(record, body, severityText, attributes, overlay) {
         severityNumber: record.severityNumber,
         body,
         eventName: record.eventName,
-        resource: overlay ? record.resource.merge(overlay) : record.resource,
+        resource,
         instrumentationScope: record.instrumentationScope,
         attributes,
         droppedAttributesCount: record.droppedAttributesCount,
@@ -146,7 +165,7 @@ class FoamLogExporter extends exporter_logs_otlp_http_1.OTLPLogExporter {
             }
             const body = redactBody(sourceBody, config);
             const attributes = (0, redaction_js_1.redactAttributesCopy)(sourceAttributes, config);
-            output.push(copyLog(record, body, severityText, attributes, overlay));
+            output.push(copyLog(record, body, severityText, attributes, redactedResource(record.resource, overlay, config)));
         }
         if (output.length === 0) {
             callback({ code: core_1.ExportResultCode.SUCCESS });
@@ -158,21 +177,31 @@ class FoamLogExporter extends exporter_logs_otlp_http_1.OTLPLogExporter {
 exports.FoamLogExporter = FoamLogExporter;
 class FoamMetricExporter extends exporter_metrics_otlp_http_1.OTLPMetricExporter {
     stamp;
-    constructor(token, stamp) {
+    options;
+    constructor(token, stamp, options = {}) {
         super({
             url: `${endpoint_js_1.endpoint}${constants_js_1.FOAM_OTLP_METRICS_PATH}`,
             headers: { Authorization: `Bearer ${token}` },
         });
         this.stamp = stamp;
+        this.options = options;
     }
     export(resourceMetrics, callback) {
-        if (!this.stamp) {
-            super.export(resourceMetrics, callback);
-            return;
-        }
+        const config = redactionConfig(this.options);
+        const overlay = this.stamp ? (0, resources_1.resourceFromAttributes)(this.stamp) : undefined;
         super.export({
             ...resourceMetrics,
-            resource: resourceMetrics.resource.merge((0, resources_1.resourceFromAttributes)(this.stamp)),
+            resource: redactedResource(resourceMetrics.resource, overlay, config),
+            scopeMetrics: resourceMetrics.scopeMetrics.map((scope) => ({
+                ...scope,
+                metrics: scope.metrics.map((metric) => ({
+                    ...metric,
+                    dataPoints: metric.dataPoints.map((point) => ({
+                        ...point,
+                        attributes: (0, redaction_js_1.redactAttributesCopy)(point.attributes, config),
+                    })),
+                })),
+            })),
         }, callback);
     }
 }

package/dist/ingest.d.ts

@@ -9,4 +9,4 @@ export interface FoamIngestOptions {
 }
 export declare function createFoamIngestSpanProcessor(name: string, environment: string, token: string, options?: FoamIngestOptions): SpanProcessor;
 export declare function createFoamIngestLogRecordProcessor(name: string, environment: string, token: string, options?: FoamIngestOptions): LogRecordProcessor;
-export declare function createFoamIngestMetricReader(name: string, environment: string, token: string): PeriodicExportingMetricReader;
+export declare function createFoamIngestMetricReader(name: string, environment: string, token: string, options?: FoamIngestOptions): PeriodicExportingMetricReader;

package/dist/ingest.js

@@ -60,10 +60,10 @@ function createFoamIngestLogRecordProcessor(name, environment, token, options =
     reportIngestSignal(state_js_1.Signals.logs, name, environment, token);
     return processor;
 }
-function createFoamIngestMetricReader(name, environment, token) {
+function createFoamIngestMetricReader(name, environment, token, options = {}) {
     const { stamp } = prepareStamp(name, environment, token);
     const reader = new sdk_metrics_1.PeriodicExportingMetricReader({
-        exporter: new exporters_js_1.FoamMetricExporter(token, stamp),
+        exporter: new exporters_js_1.FoamMetricExporter(token, stamp, prepareOptions(options)),
     });
     reportIngestSignal(state_js_1.Signals.metrics, name, environment, token);
     return reader;

package/dist/init.js

@@ -107,7 +107,9 @@ function init(options) {
             resource,
             readers: [
                 new sdk_metrics_1.PeriodicExportingMetricReader({
-                    exporter: new exporters_js_1.FoamMetricExporter(options.token),
+                    exporter: new exporters_js_1.FoamMetricExporter(options.token, undefined, {
+                        redaction: redactionConfig,
+                    }),
                 }),
                 ...(options.additionalMetricReaders ?? []),
             ],

package/dist/redaction-keys.d.ts

@@ -1,3 +1,4 @@
 export declare const SENSITIVE_KEYS: readonly ["admin_password", "basic_auth_password", "confirm_password", "connection_password", "current_password", "database_password", "db_pass", "db_password", "ftp_password", "http_password", "keystore_password", "master_password", "mail_password", "mysql_pwd", "new_password", "old_password", "pass", "passcode", "passphrase", "passwd", "password", "password_confirmation", "postgres_password", "pwd", "redis_password", "root_password", "smtp_password", "user_password", "access_token_secret", "activation_token", "access_token", "api_token", "assertion", "auth", "auth_token", "authentication_token", "authorization", "authorization_code", "bearer", "bearer_token", "bot_token", "ci_job_token", "client_assertion", "client_secret", "credential", "credentials", "deploy_token", "email_verification_token", "id_token", "identity_token", "invite_token", "jwt", "jwt_token", "magic_link_token", "oauth_token", "oauth2_token", "oauth_token_secret", "password_reset_token", "personal_access_token", "registration_token", "request_token", "refresh_token", "reset_token", "saml_assertion", "saml_response", "secret_token", "security_token", "service_token", "sso_token", "token", "unsubscribe_token", "verification_token", "access_key", "access_key_id", "api_key", "api_secret", "amqp_url", "apikey", "app_key", "app_secret", "application_key", "application_secret", "aws_access_key_id", "aws_secret_access_key", "consumer_key", "consumer_secret", "broker_url", "connection_string", "connection_uri", "credential_blob", "decryption_key", "database_url", "database_connection_string", "db_url", "dsn", "encryption_key", "gcp_service_account_key", "google_application_credentials", "key", "key_password", "key_store_password", "keystore", "license_key", "mnemonic", "mongodb_uri", "kube_config", "kubeconfig", "pem", "private_key", "privatekey", "proxy_authorization", "redis_url", "redis_uri", "rabbitmq_url", "secret", "secret_access_key", "secret_key", "seed_phrase", "service_account_json", "service_account_key", "shared_secret", "signature", "signing_key", "signing_secret", "ssh_private_key", "smtp_url", "tls_private_key", "wallet_private_key", "wallet_seed", "webhook_secret", "www_authenticate", "_csrf", "_csrf_token", "_session", "_xsrf", "aiohttp_session", "anti_forgery_token", "backup_code", "backup_codes", "connect.sid", "cookie", "csrf", "csrf_token", "csrftoken", "django_session", "hotp", "laravel_session", "mfa", "mfa_code", "otp", "phpsessid", "pin", "recovery_code", "recovery_codes", "remember_token", "session", "session_id", "session_key", "session_token", "sessionid", "set_cookie", "setcookie", "sid", "symfony", "totp", "user_session", "x_csrf_token", "x_csrftoken", "x_xsrf_token", "xsrf", "xsrf_token", "account_number", "bank_account", "card", "card_number", "credit_card", "credit_card_number", "cvc", "cvv", "date_of_birth", "dob", "driver_license", "drivers_license", "iban", "ip_address", "national_id", "passport_number", "remote_addr", "routing_number", "sort_code", "ssn", "tax_id", "x_forwarded_for", "x_real_ip", "algolia_admin_api_key", "anthropic_api_key", "artifactory_api_key", "airtable_api_key", "azure_api_key", "buildkite_agent_token", "circle_token", "cohere_api_key", "cloudflare_api_token", "consul_http_token", "datadog_api_key", "datadog_app_key", "discord_bot_token", "docker_password", "docker_config_json", "digitalocean_token", "firebase_service_account", "gemini_api_key", "github_token", "gitlab_token", "google_api_key", "groq_api_key", "honeycomb_api_key", "huggingface_token", "heroku_api_key", "jfrog_access_token", "linear_api_key", "mapbox_access_token", "new_relic_license_key", "nomad_token", "notion_token", "npm_token", "openai_api_key", "pagerduty_routing_key", "pypi_token", "sentry_auth_token", "sentry_dsn", "sendgrid_api_key", "shopify_access_token", "shopify_api_secret", "slack_app_token", "slack_bot_token", "slack_signing_secret", "stripe_secret_key", "stripe_webhook_secret", "supabase_service_role_key", "telegram_bot_token", "terraform_cloud_token", "twilio_auth_token", "vault_token", "vercel_oidc_token", "x_api_key", "x_auth_token"];
+export declare const SENSITIVE_KEY_SEGMENTS: readonly ["apikey", "assertion", "auth", "bearer", "cookie", "cookies", "credential", "credentials", "csrf", "cvc", "cvv", "dsn", "hotp", "iban", "jwt", "mfa", "mnemonic", "otp", "passcode", "passphrase", "passport", "passwd", "password", "passwords", "pin", "pwd", "secret", "secrets", "session", "signature", "ssn", "token", "totp", "xsrf", "access_key", "account_number", "api_key", "app_key", "application_key", "card_number", "connection_string", "decryption_key", "encryption_key", "license_key", "master_key", "private_key", "routing_number", "secret_key", "seed_phrase", "service_account", "signing_key", "ssh_key"];
 export declare const SENSITIVE_HTTP_HEADERS: readonly ["authentication_info", "authorization", "cf_access_authenticated_user_email", "cf_access_jwt_assertion", "cookie", "grpcgateway_authorization", "impersonate_group", "impersonate_user", "jenkins_crumb", "job_token", "ocp_apim_subscription_key", "private_token", "proxy_authenticate", "proxy_authentication_info", "proxy_authorization", "set_cookie", "stripe_signature", "www_authenticate", "x_access_token", "x_algolia_api_key", "x_amz_credential", "x_amz_security_token", "x_amz_signature", "x_amzn_oidc_accesstoken", "x_amzn_oidc_data", "x_amzn_oidc_identity", "x_api_key", "x_asana_request_token", "x_aws_ec2_metadata_token", "x_auth_request_access_token", "x_auth_request_email", "x_auth_request_groups", "x_auth_request_preferred_username", "x_auth_request_user", "x_auth_token", "x_box_signature_primary", "x_box_signature_secondary", "x_cf_access_jwt_assertion", "x_csrf_token", "x_circle_token", "x_consul_token", "x_credential_identifier", "x_datadog_api_key", "x_discord_signature_ed25519", "x_docusign_signature_1", "x_dropbox_signature", "x_elastic_client_authentication", "x_firebase_appcheck", "x_forwarded_access_token", "x_forwarded_email", "x_forwarded_for", "x_forwarded_user", "x_functions_key", "x_github_token", "x_gitlab_token", "x_goog_api_key", "x_goog_firebase_installations_auth", "x_goog_iap_jwt_assertion", "x_hub_signature", "x_hub_signature_256", "x_honeycomb_api_key", "x_honeycomb_team", "x_intercom_hmac", "x_jwt_assertion", "x_linear_signature", "x_mailgun_signature", "x_master_key", "x_meili_api_key", "x_ms_client_principal", "x_ms_token_aad_access_token", "x_ms_token_aad_id_token", "x_ms_token_aad_refresh_token", "x_nf_client_connection_ip", "x_nomad_token", "x_npm_token", "x_original_authorization", "x_real_ip", "x_remote_email", "x_remote_groups", "x_remote_user", "x_pagerduty_signature", "x_parse_rest_api_key", "x_sendgrid_event_webhook_signature", "x_session_token", "x_shopify_hmac_sha256", "x_signature", "x_signature_ed25519", "x_slack_signature", "x_sonarqube_passcode", "x_squarespace_hmacsha256_signature", "x_twilio_signature", "x_typesense_api_key", "x_userinfo", "x_vault_token", "x_vercel_oidc_token", "x_webhook_signature", "x_webhook_secret", "x_wix_webhook_signature", "x_xsrf_token", "x_zendesk_webhook_signature"];
 export declare const SENSITIVE_QUERY_KEYS: readonly ["access_token", "api_key", "api_secret", "api_token", "apikey", "assertion", "auth", "auth_token", "authorization", "authorization_code", "bearer_token", "client_assertion", "client_secret", "code", "code_verifier", "credential", "hmac", "id_token", "invite_token", "jwt", "key", "magic_link_token", "oauth_token_secret", "otp", "password_reset_token", "password", "policy", "pin", "refresh_token", "reset_token", "saml_response", "secret", "secret_key", "session", "session_id", "session_token", "sig", "signature", "token", "token_secret", "unsubscribe_token", "verification_token", "x_amz_credential", "x_amz_security_token", "x_amz_signature", "x_goog_credential", "x_goog_signature"];

package/dist/redaction-keys.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SENSITIVE_QUERY_KEYS = exports.SENSITIVE_HTTP_HEADERS = exports.SENSITIVE_KEYS = void 0;
+exports.SENSITIVE_QUERY_KEYS = exports.SENSITIVE_HTTP_HEADERS = exports.SENSITIVE_KEY_SEGMENTS = exports.SENSITIVE_KEYS = void 0;
 const PASSWORD_KEYS = [
     "admin_password",
     "basic_auth_password",
@@ -268,6 +268,65 @@ exports.SENSITIVE_KEYS = [
     ...PERSONAL_AND_FINANCIAL_KEYS,
     ...PROVIDER_KEYS,
 ];
+// Matched as whole underscore-separated segments of the normalized key, so
+// any name *containing* one of these is caught without enumerating every
+// variant: "legacy_api_key_2" matches "api_key", "stripeToken" matches
+// "token", while "tokenizer" and "secretary" match nothing. Terms that would
+// over-match as bare segments (e.g. "key", "code") appear only in compounds.
+exports.SENSITIVE_KEY_SEGMENTS = [
+    "apikey",
+    "assertion",
+    "auth",
+    "bearer",
+    "cookie",
+    "cookies",
+    "credential",
+    "credentials",
+    "csrf",
+    "cvc",
+    "cvv",
+    "dsn",
+    "hotp",
+    "iban",
+    "jwt",
+    "mfa",
+    "mnemonic",
+    "otp",
+    "passcode",
+    "passphrase",
+    "passport",
+    "passwd",
+    "password",
+    "passwords",
+    "pin",
+    "pwd",
+    "secret",
+    "secrets",
+    "session",
+    "signature",
+    "ssn",
+    "token",
+    "totp",
+    "xsrf",
+    "access_key",
+    "account_number",
+    "api_key",
+    "app_key",
+    "application_key",
+    "card_number",
+    "connection_string",
+    "decryption_key",
+    "encryption_key",
+    "license_key",
+    "master_key",
+    "private_key",
+    "routing_number",
+    "secret_key",
+    "seed_phrase",
+    "service_account",
+    "signing_key",
+    "ssh_key",
+];
 exports.SENSITIVE_HTTP_HEADERS = [
     "authentication_info",
     "authorization",

package/dist/redaction.js

@@ -21,9 +21,10 @@ const EMPTY_CONFIG = {
     secretKeys: new Set(),
     piiKeys: new Set(),
 };
-const FLOOR_KEYS = new Set(redaction_keys_js_1.SENSITIVE_KEYS);
-const HTTP_HEADERS = new Set(redaction_keys_js_1.SENSITIVE_HTTP_HEADERS);
-const QUERY_KEYS = new Set(redaction_keys_js_1.SENSITIVE_QUERY_KEYS);
+// Lists are normalized like lookups so entries such as "connect.sid" match.
+const FLOOR_KEYS = new Set(redaction_keys_js_1.SENSITIVE_KEYS.map(normalizeKey));
+const HTTP_HEADERS = new Set(redaction_keys_js_1.SENSITIVE_HTTP_HEADERS.map(normalizeKey));
+const QUERY_KEYS = new Set(redaction_keys_js_1.SENSITIVE_QUERY_KEYS.map(normalizeKey));
 const HEADER_PREFIXES = ["http.request.header.", "http.response.header."];
 const BARE_QUERY_KEYS = new Set(["url.query"]);
 const BODY_KEYS = new Set([
@@ -44,22 +45,32 @@ function normalizeKey(key) {
         .trim()
         .replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2")
         .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
-        .replace(/-/g, "_")
+        .replace(/[-.]/g, "_")
         .toLowerCase();
 }
+const FLOOR_SEGMENTS = redaction_keys_js_1.SENSITIVE_KEY_SEGMENTS.map((segment) => `_${segment}_`);
+// Underscore padding makes containment whole-segment: "_my_api_key_2_"
+// contains "_api_key_", while "_monkey_" and "_authorized_" contain nothing.
+function hasFloorSegment(normalized) {
+    const padded = `_${normalized}_`;
+    return FLOOR_SEGMENTS.some((segment) => padded.includes(segment));
+}
+function isFloorName(normalized) {
+    return FLOOR_KEYS.has(normalized) || hasFloorSegment(normalized);
+}
 function isFloorKey(key) {
-    return FLOOR_KEYS.has(normalizeKey(key));
+    return isFloorName(normalizeKey(key));
 }
 function isSensitiveHeader(key) {
     return HTTP_HEADERS.has(normalizeKey(key));
 }
 function isSensitiveQueryKey(key) {
     const normalized = normalizeKey(key);
-    return FLOOR_KEYS.has(normalized) || QUERY_KEYS.has(normalized);
+    return isFloorName(normalized) || QUERY_KEYS.has(normalized);
 }
 function keyMatch(key, config = activeConfig) {
     const normalized = normalizeKey(key);
-    if (FLOOR_KEYS.has(normalized))
+    if (isFloorName(normalized))
         return "floor";
     if (config.piiKeys.has(normalized))
         return "pii";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foam-ai/node",
-  "version": "0.1.0-alpha.10",
+  "version": "0.1.0-alpha.12",
   "description": "Foam JavaScript Node.js SDK",
   "license": "Apache-2.0",
   "repository": {