@foam-ai/node 0.1.0-alpha.4 → 0.1.0-alpha.6

package/dist/network-capture/undici.js

@@ -6,6 +6,7 @@ const node_diagnostics_channel_1 = require("node:diagnostics_channel");
 const utils_js_1 = require("../utils.js");
 const collector_js_1 = require("./collector.js");
 const undiciSessions = new WeakMap();
+const legacyWrappedRequests = new WeakSet();
 let undiciBodyChannelsBound = false;
 function appendHeader(headers, rawName, value) {
     const name = String(rawName).toLowerCase();
@@ -90,19 +91,50 @@ function bindUndiciChannel(name, handle) {
         });
     });
 }
+function wrapLegacyBodyMethod(request, name, direction) {
+    const target = request;
+    const original = target[name];
+    if (typeof original !== "function")
+        return;
+    target[name] = function (chunk, ...rest) {
+        const result = original.call(this, chunk, ...rest);
+        (0, utils_js_1.safely)(() => {
+            const session = undiciSessions.get(request);
+            if (!session || session.modernBodyChannels)
+                return;
+            undiciCollector(session, direction)?.observe(chunk);
+        });
+        return result;
+    };
+}
+function bindLegacyUndiciBodyMethods(request) {
+    if (legacyWrappedRequests.has(request))
+        return;
+    legacyWrappedRequests.add(request);
+    wrapLegacyBodyMethod(request, "onBodySent", "request");
+    wrapLegacyBodyMethod(request, "onData", "response");
+    wrapLegacyBodyMethod(request, "onResponseData", "response");
+}
 function bindUndiciBodyChannels() {
     if (undiciBodyChannelsBound)
         return;
     undiciBodyChannelsBound = true;
-    // Subscribe before UndiciInstrumentation.enable() so trailers run while
-    // the span is still recording. BodyCollector is created on first chunk.
+    (0, node_diagnostics_channel_1.subscribe)("undici:request:create", (message) => {
+        (0, utils_js_1.safely)(() => {
+            const request = undiciRequest(message);
+            if (request)
+                bindLegacyUndiciBodyMethods(request);
+        });
+    });
     bindUndiciChannel("undici:request:bodyChunkSent", (message, _request, session) => {
+        session.modernBodyChannels = true;
         undiciCollector(session, "request")?.observe(message.chunk);
     });
     bindUndiciChannel("undici:request:bodySent", (_message, _request, session) => {
         session.requestBody?.finalize(true);
     });
     bindUndiciChannel("undici:request:bodyChunkReceived", (message, _request, session) => {
+        session.modernBodyChannels = true;
         undiciCollector(session, "response")?.observe(message.chunk);
     });
     bindUndiciChannel("undici:request:trailers", (_message, request) => {
@@ -112,33 +144,34 @@ function bindUndiciBodyChannels() {
         finishUndici(request, false);
     });
 }
-/**
- * Builds OTel Undici/fetch hooks. Headers use the same allowlist as Node HTTP.
- * Bodies are copied from diagnostics_channel chunks — never from fetch streams.
- */
 function createUndiciNetworkCaptureHooks(bodyCaptureEnabled = true) {
     if (bodyCaptureEnabled)
         bindUndiciBodyChannels();
     return {
         requestHook(span, request) {
-            const headers = undiciRequestHeaders(request.headers);
-            (0, collector_js_1.setHeaderAttributes)(span, "request", headers);
-            if (!bodyCaptureEnabled ||
-                !span.isRecording() ||
-                (span.spanContext().traceFlags & api_1.TraceFlags.SAMPLED) !==
-                    api_1.TraceFlags.SAMPLED) {
-                return;
-            }
-            undiciSessions.set(request, { span, requestHeaders: headers });
+            (0, utils_js_1.safely)(() => {
+                const headers = undiciRequestHeaders(request.headers);
+                (0, collector_js_1.setHeaderAttributes)(span, "request", headers);
+                if (!bodyCaptureEnabled ||
+                    !span.isRecording() ||
+                    (span.spanContext().traceFlags & api_1.TraceFlags.SAMPLED) !==
+                        api_1.TraceFlags.SAMPLED) {
+                    return;
+                }
+                undiciSessions.set(request, { span, requestHeaders: headers });
+                bindLegacyUndiciBodyMethods(request);
+            });
         },
         responseHook(span, info) {
-            const headers = undiciResponseHeaders(info.response.headers);
-            (0, collector_js_1.setHeaderAttributes)(span, "response", headers);
-            if (!bodyCaptureEnabled || info.request === undefined)
-                return;
-            const session = undiciSessions.get(info.request);
-            if (session)
-                session.responseHeaders = headers;
+            (0, utils_js_1.safely)(() => {
+                const headers = undiciResponseHeaders(info.response.headers);
+                (0, collector_js_1.setHeaderAttributes)(span, "response", headers);
+                if (!bodyCaptureEnabled || info.request === undefined)
+                    return;
+                const session = undiciSessions.get(info.request);
+                if (session)
+                    session.responseHeaders = headers;
+            });
         },
     };
 }

package/dist/otlp.d.ts

@@ -0,0 +1,8 @@
+import type { SeverityNumber } from "@opentelemetry/api-logs";
+export declare function sendOtlpLog({ token, resourceAttributes, scopeName, severityNumber, body, }: {
+    token: string;
+    resourceAttributes: Record<string, string>;
+    scopeName: string;
+    severityNumber: SeverityNumber;
+    body: string;
+}): Promise<void>;

package/dist/otlp.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sendOtlpLog = sendOtlpLog;
+const constants_js_1 = require("./constants.js");
+const endpoint_js_1 = require("./endpoint.js");
+// pcga11: Pipeline-independent OTLP log delivery.
+// Use when the SDK's LoggerProvider/exporter never got set up or is
+// broken (diagnostics). Not a client surface: no batching, no resource
+// detectors, no trace correlation, one fetch per record. Client logs go
+// through the Foam LoggerProvider in logs.ts.
+async function sendOtlpLog({ token, resourceAttributes, scopeName, severityNumber, body, }) {
+    try {
+        await fetch(`${endpoint_js_1.endpoint}${constants_js_1.FOAM_OTLP_LOGS_PATH}`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                resourceLogs: [
+                    {
+                        resource: {
+                            attributes: Object.entries(resourceAttributes).map(([key, value]) => ({ key, value: { stringValue: value } })),
+                        },
+                        scopeLogs: [
+                            {
+                                scope: { name: scopeName },
+                                logRecords: [
+                                    {
+                                        timeUnixNano: String(BigInt(Date.now()) * 1000000n),
+                                        severityNumber,
+                                        severityText: constants_js_1.SEVERITY_TEXT[severityNumber],
+                                        body: { stringValue: body },
+                                    },
+                                ],
+                            },
+                        ],
+                    },
+                ],
+            }),
+        });
+    }
+    catch {
+        // pcga11: do not remove this catch block. Ingest must never throw into application code.
+    }
+}

package/dist/propagation.d.ts

@@ -1,5 +1,5 @@
 import { type Context } from "@opentelemetry/api";
 export declare function injectTraceContext(carrier: Record<string, string>): void;
 export declare function extractTraceContext(carrier: Record<string, string>): Context;
-export declare const setBaggage: (key: string, value: string) => void;
+export declare function setBaggage<T>(key: string, value: string, callback: () => T): T | undefined;
 export declare function getBaggage(key: string): string | undefined;

package/dist/propagation.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.setBaggage = void 0;
 exports.injectTraceContext = injectTraceContext;
 exports.extractTraceContext = extractTraceContext;
+exports.setBaggage = setBaggage;
 exports.getBaggage = getBaggage;
 const node_async_hooks_1 = require("node:async_hooks");
 const api_1 = require("@opentelemetry/api");
@@ -34,11 +34,13 @@ function injectTraceContext(carrier) {
 function extractTraceContext(carrier) {
     return (0, utils_js_1.safely)(() => propagator.extract(api_1.context.active(), carrier, api_1.defaultTextMapGetter), api_1.context.active());
 }
-exports.setBaggage = (0, utils_js_1.whenInitialized)(state_js_1.Signals.baggage, (key, value) => {
+function setBaggage(key, value, callback) {
+    if ((0, state_js_1.getSignal)(state_js_1.Signals.baggage) === state_js_1.SignalSources.none)
+        return undefined;
     const next = new Map(baggageStorage.getStore() ?? []);
     next.set(key, value);
-    baggageStorage.enterWith(next);
-});
+    return baggageStorage.run(next, callback);
+}
 function getBaggage(key) {
     return (0, utils_js_1.safely)(() => baggageStorage.getStore()?.get(key) ??
         api_1.propagation.getBaggage(api_1.context.active())?.getEntry(key)?.value, undefined);

package/dist/redaction-keys.d.ts

@@ -0,0 +1,3 @@
+export declare const SENSITIVE_KEYS: readonly ["admin_password", "basic_auth_password", "confirm_password", "connection_password", "current_password", "database_password", "db_pass", "db_password", "ftp_password", "http_password", "keystore_password", "master_password", "mail_password", "mysql_pwd", "new_password", "old_password", "pass", "passcode", "passphrase", "passwd", "password", "password_confirmation", "postgres_password", "pwd", "redis_password", "root_password", "smtp_password", "user_password", "access_token_secret", "activation_token", "access_token", "api_token", "assertion", "auth", "auth_token", "authentication_token", "authorization", "authorization_code", "bearer", "bearer_token", "bot_token", "ci_job_token", "client_assertion", "client_secret", "credential", "credentials", "deploy_token", "email_verification_token", "id_token", "identity_token", "invite_token", "jwt", "jwt_token", "magic_link_token", "oauth_token", "oauth2_token", "oauth_token_secret", "password_reset_token", "personal_access_token", "registration_token", "request_token", "refresh_token", "reset_token", "saml_assertion", "saml_response", "secret_token", "security_token", "service_token", "sso_token", "token", "unsubscribe_token", "verification_token", "access_key", "access_key_id", "api_key", "api_secret", "amqp_url", "apikey", "app_key", "app_secret", "application_key", "application_secret", "aws_access_key_id", "aws_secret_access_key", "consumer_key", "consumer_secret", "broker_url", "connection_string", "connection_uri", "credential_blob", "decryption_key", "database_url", "database_connection_string", "db_url", "dsn", "encryption_key", "gcp_service_account_key", "google_application_credentials", "key", "key_password", "key_store_password", "keystore", "license_key", "mnemonic", "mongodb_uri", "kube_config", "kubeconfig", "pem", "private_key", "privatekey", "proxy_authorization", "redis_url", "redis_uri", "rabbitmq_url", "secret", "secret_access_key", "secret_key", "seed_phrase", "service_account_json", "service_account_key", "shared_secret", "signature", "signing_key", "signing_secret", "ssh_private_key", "smtp_url", "tls_private_key", "wallet_private_key", "wallet_seed", "webhook_secret", "www_authenticate", "_csrf", "_csrf_token", "_session", "_xsrf", "aiohttp_session", "anti_forgery_token", "backup_code", "backup_codes", "connect.sid", "cookie", "csrf", "csrf_token", "csrftoken", "django_session", "hotp", "laravel_session", "mfa", "mfa_code", "otp", "phpsessid", "pin", "recovery_code", "recovery_codes", "remember_token", "session", "session_id", "session_key", "session_token", "sessionid", "set_cookie", "setcookie", "sid", "symfony", "totp", "user_session", "x_csrf_token", "x_csrftoken", "x_xsrf_token", "xsrf", "xsrf_token", "account_number", "bank_account", "card", "card_number", "credit_card", "credit_card_number", "cvc", "cvv", "date_of_birth", "dob", "driver_license", "drivers_license", "iban", "ip_address", "national_id", "passport_number", "remote_addr", "routing_number", "sort_code", "ssn", "tax_id", "x_forwarded_for", "x_real_ip", "algolia_admin_api_key", "anthropic_api_key", "artifactory_api_key", "airtable_api_key", "azure_api_key", "buildkite_agent_token", "circle_token", "cohere_api_key", "cloudflare_api_token", "consul_http_token", "datadog_api_key", "datadog_app_key", "discord_bot_token", "docker_password", "docker_config_json", "digitalocean_token", "firebase_service_account", "gemini_api_key", "github_token", "gitlab_token", "google_api_key", "groq_api_key", "honeycomb_api_key", "huggingface_token", "heroku_api_key", "jfrog_access_token", "linear_api_key", "mapbox_access_token", "new_relic_license_key", "nomad_token", "notion_token", "npm_token", "openai_api_key", "pagerduty_routing_key", "pypi_token", "sentry_auth_token", "sentry_dsn", "sendgrid_api_key", "shopify_access_token", "shopify_api_secret", "slack_app_token", "slack_bot_token", "slack_signing_secret", "stripe_secret_key", "stripe_webhook_secret", "supabase_service_role_key", "telegram_bot_token", "terraform_cloud_token", "twilio_auth_token", "vault_token", "vercel_oidc_token", "x_api_key", "x_auth_token"];
+export declare const SENSITIVE_HTTP_HEADERS: readonly ["authentication_info", "authorization", "cf_access_authenticated_user_email", "cf_access_jwt_assertion", "cookie", "grpcgateway_authorization", "impersonate_group", "impersonate_user", "jenkins_crumb", "job_token", "ocp_apim_subscription_key", "private_token", "proxy_authenticate", "proxy_authentication_info", "proxy_authorization", "set_cookie", "stripe_signature", "www_authenticate", "x_access_token", "x_algolia_api_key", "x_amz_credential", "x_amz_security_token", "x_amz_signature", "x_amzn_oidc_accesstoken", "x_amzn_oidc_data", "x_amzn_oidc_identity", "x_api_key", "x_asana_request_token", "x_aws_ec2_metadata_token", "x_auth_request_access_token", "x_auth_request_email", "x_auth_request_groups", "x_auth_request_preferred_username", "x_auth_request_user", "x_auth_token", "x_box_signature_primary", "x_box_signature_secondary", "x_cf_access_jwt_assertion", "x_csrf_token", "x_circle_token", "x_consul_token", "x_credential_identifier", "x_datadog_api_key", "x_discord_signature_ed25519", "x_docusign_signature_1", "x_dropbox_signature", "x_elastic_client_authentication", "x_firebase_appcheck", "x_forwarded_access_token", "x_forwarded_email", "x_forwarded_for", "x_forwarded_user", "x_functions_key", "x_github_token", "x_gitlab_token", "x_goog_api_key", "x_goog_firebase_installations_auth", "x_goog_iap_jwt_assertion", "x_hub_signature", "x_hub_signature_256", "x_honeycomb_api_key", "x_honeycomb_team", "x_intercom_hmac", "x_jwt_assertion", "x_linear_signature", "x_mailgun_signature", "x_master_key", "x_meili_api_key", "x_ms_client_principal", "x_ms_token_aad_access_token", "x_ms_token_aad_id_token", "x_ms_token_aad_refresh_token", "x_nf_client_connection_ip", "x_nomad_token", "x_npm_token", "x_original_authorization", "x_real_ip", "x_remote_email", "x_remote_groups", "x_remote_user", "x_pagerduty_signature", "x_parse_rest_api_key", "x_sendgrid_event_webhook_signature", "x_session_token", "x_shopify_hmac_sha256", "x_signature", "x_signature_ed25519", "x_slack_signature", "x_sonarqube_passcode", "x_squarespace_hmacsha256_signature", "x_twilio_signature", "x_typesense_api_key", "x_userinfo", "x_vault_token", "x_vercel_oidc_token", "x_webhook_signature", "x_webhook_secret", "x_wix_webhook_signature", "x_xsrf_token", "x_zendesk_webhook_signature"];
+export declare const SENSITIVE_QUERY_KEYS: readonly ["access_token", "api_key", "api_secret", "api_token", "apikey", "assertion", "auth", "auth_token", "authorization", "authorization_code", "bearer_token", "client_assertion", "client_secret", "code", "code_verifier", "credential", "hmac", "id_token", "invite_token", "jwt", "key", "magic_link_token", "oauth_token_secret", "otp", "password_reset_token", "password", "policy", "pin", "refresh_token", "reset_token", "saml_response", "secret", "secret_key", "session", "session_id", "session_token", "sig", "signature", "token", "token_secret", "unsubscribe_token", "verification_token", "x_amz_credential", "x_amz_security_token", "x_amz_signature", "x_goog_credential", "x_goog_signature"];

package/dist/redaction-keys.js

@@ -0,0 +1,421 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_QUERY_KEYS = exports.SENSITIVE_HTTP_HEADERS = exports.SENSITIVE_KEYS = void 0;
+const PASSWORD_KEYS = [
+    "admin_password",
+    "basic_auth_password",
+    "confirm_password",
+    "connection_password",
+    "current_password",
+    "database_password",
+    "db_pass",
+    "db_password",
+    "ftp_password",
+    "http_password",
+    "keystore_password",
+    "master_password",
+    "mail_password",
+    "mysql_pwd",
+    "new_password",
+    "old_password",
+    "pass",
+    "passcode",
+    "passphrase",
+    "passwd",
+    "password",
+    "password_confirmation",
+    "postgres_password",
+    "pwd",
+    "redis_password",
+    "root_password",
+    "smtp_password",
+    "user_password",
+];
+const TOKEN_KEYS = [
+    "access_token_secret",
+    "activation_token",
+    "access_token",
+    "api_token",
+    "assertion",
+    "auth",
+    "auth_token",
+    "authentication_token",
+    "authorization",
+    "authorization_code",
+    "bearer",
+    "bearer_token",
+    "bot_token",
+    "ci_job_token",
+    "client_assertion",
+    "client_secret",
+    "credential",
+    "credentials",
+    "deploy_token",
+    "email_verification_token",
+    "id_token",
+    "identity_token",
+    "invite_token",
+    "jwt",
+    "jwt_token",
+    "magic_link_token",
+    "oauth_token",
+    "oauth2_token",
+    "oauth_token_secret",
+    "password_reset_token",
+    "personal_access_token",
+    "registration_token",
+    "request_token",
+    "refresh_token",
+    "reset_token",
+    "saml_assertion",
+    "saml_response",
+    "secret_token",
+    "security_token",
+    "service_token",
+    "sso_token",
+    "token",
+    "unsubscribe_token",
+    "verification_token",
+];
+const KEY_MATERIAL_KEYS = [
+    "access_key",
+    "access_key_id",
+    "api_key",
+    "api_secret",
+    "amqp_url",
+    "apikey",
+    "app_key",
+    "app_secret",
+    "application_key",
+    "application_secret",
+    "aws_access_key_id",
+    "aws_secret_access_key",
+    "consumer_key",
+    "consumer_secret",
+    "broker_url",
+    "connection_string",
+    "connection_uri",
+    "credential_blob",
+    "decryption_key",
+    "database_url",
+    "database_connection_string",
+    "db_url",
+    "dsn",
+    "encryption_key",
+    "gcp_service_account_key",
+    "google_application_credentials",
+    "key",
+    "key_password",
+    "key_store_password",
+    "keystore",
+    "license_key",
+    "mnemonic",
+    "mongodb_uri",
+    "kube_config",
+    "kubeconfig",
+    "pem",
+    "private_key",
+    "privatekey",
+    "proxy_authorization",
+    "redis_url",
+    "redis_uri",
+    "rabbitmq_url",
+    "secret",
+    "secret_access_key",
+    "secret_key",
+    "seed_phrase",
+    "service_account_json",
+    "service_account_key",
+    "shared_secret",
+    "signature",
+    "signing_key",
+    "signing_secret",
+    "ssh_private_key",
+    "smtp_url",
+    "tls_private_key",
+    "wallet_private_key",
+    "wallet_seed",
+    "webhook_secret",
+    "www_authenticate",
+];
+const SESSION_KEYS = [
+    "_csrf",
+    "_csrf_token",
+    "_session",
+    "_xsrf",
+    "aiohttp_session",
+    "anti_forgery_token",
+    "backup_code",
+    "backup_codes",
+    "connect.sid",
+    "cookie",
+    "csrf",
+    "csrf_token",
+    "csrftoken",
+    "django_session",
+    "hotp",
+    "laravel_session",
+    "mfa",
+    "mfa_code",
+    "otp",
+    "phpsessid",
+    "pin",
+    "recovery_code",
+    "recovery_codes",
+    "remember_token",
+    "session",
+    "session_id",
+    "session_key",
+    "session_token",
+    "sessionid",
+    "set_cookie",
+    "setcookie",
+    "sid",
+    "symfony",
+    "totp",
+    "user_session",
+    "x_csrf_token",
+    "x_csrftoken",
+    "x_xsrf_token",
+    "xsrf",
+    "xsrf_token",
+];
+const PERSONAL_AND_FINANCIAL_KEYS = [
+    "account_number",
+    "bank_account",
+    "card",
+    "card_number",
+    "credit_card",
+    "credit_card_number",
+    "cvc",
+    "cvv",
+    "date_of_birth",
+    "dob",
+    "driver_license",
+    "drivers_license",
+    "iban",
+    "ip_address",
+    "national_id",
+    "passport_number",
+    "remote_addr",
+    "routing_number",
+    "sort_code",
+    "ssn",
+    "tax_id",
+    "x_forwarded_for",
+    "x_real_ip",
+];
+const PROVIDER_KEYS = [
+    "algolia_admin_api_key",
+    "anthropic_api_key",
+    "artifactory_api_key",
+    "airtable_api_key",
+    "azure_api_key",
+    "buildkite_agent_token",
+    "circle_token",
+    "cohere_api_key",
+    "cloudflare_api_token",
+    "consul_http_token",
+    "datadog_api_key",
+    "datadog_app_key",
+    "discord_bot_token",
+    "docker_password",
+    "docker_config_json",
+    "digitalocean_token",
+    "firebase_service_account",
+    "gemini_api_key",
+    "github_token",
+    "gitlab_token",
+    "google_api_key",
+    "groq_api_key",
+    "honeycomb_api_key",
+    "huggingface_token",
+    "heroku_api_key",
+    "jfrog_access_token",
+    "linear_api_key",
+    "mapbox_access_token",
+    "new_relic_license_key",
+    "nomad_token",
+    "notion_token",
+    "npm_token",
+    "openai_api_key",
+    "pagerduty_routing_key",
+    "pypi_token",
+    "sentry_auth_token",
+    "sentry_dsn",
+    "sendgrid_api_key",
+    "shopify_access_token",
+    "shopify_api_secret",
+    "slack_app_token",
+    "slack_bot_token",
+    "slack_signing_secret",
+    "stripe_secret_key",
+    "stripe_webhook_secret",
+    "supabase_service_role_key",
+    "telegram_bot_token",
+    "terraform_cloud_token",
+    "twilio_auth_token",
+    "vault_token",
+    "vercel_oidc_token",
+    "x_api_key",
+    "x_auth_token",
+];
+exports.SENSITIVE_KEYS = [
+    ...PASSWORD_KEYS,
+    ...TOKEN_KEYS,
+    ...KEY_MATERIAL_KEYS,
+    ...SESSION_KEYS,
+    ...PERSONAL_AND_FINANCIAL_KEYS,
+    ...PROVIDER_KEYS,
+];
+exports.SENSITIVE_HTTP_HEADERS = [
+    "authentication_info",
+    "authorization",
+    "cf_access_authenticated_user_email",
+    "cf_access_jwt_assertion",
+    "cookie",
+    "grpcgateway_authorization",
+    "impersonate_group",
+    "impersonate_user",
+    "jenkins_crumb",
+    "job_token",
+    "ocp_apim_subscription_key",
+    "private_token",
+    "proxy_authenticate",
+    "proxy_authentication_info",
+    "proxy_authorization",
+    "set_cookie",
+    "stripe_signature",
+    "www_authenticate",
+    "x_access_token",
+    "x_algolia_api_key",
+    "x_amz_credential",
+    "x_amz_security_token",
+    "x_amz_signature",
+    "x_amzn_oidc_accesstoken",
+    "x_amzn_oidc_data",
+    "x_amzn_oidc_identity",
+    "x_api_key",
+    "x_asana_request_token",
+    "x_aws_ec2_metadata_token",
+    "x_auth_request_access_token",
+    "x_auth_request_email",
+    "x_auth_request_groups",
+    "x_auth_request_preferred_username",
+    "x_auth_request_user",
+    "x_auth_token",
+    "x_box_signature_primary",
+    "x_box_signature_secondary",
+    "x_cf_access_jwt_assertion",
+    "x_csrf_token",
+    "x_circle_token",
+    "x_consul_token",
+    "x_credential_identifier",
+    "x_datadog_api_key",
+    "x_discord_signature_ed25519",
+    "x_docusign_signature_1",
+    "x_dropbox_signature",
+    "x_elastic_client_authentication",
+    "x_firebase_appcheck",
+    "x_forwarded_access_token",
+    "x_forwarded_email",
+    "x_forwarded_for",
+    "x_forwarded_user",
+    "x_functions_key",
+    "x_github_token",
+    "x_gitlab_token",
+    "x_goog_api_key",
+    "x_goog_firebase_installations_auth",
+    "x_goog_iap_jwt_assertion",
+    "x_hub_signature",
+    "x_hub_signature_256",
+    "x_honeycomb_api_key",
+    "x_honeycomb_team",
+    "x_intercom_hmac",
+    "x_jwt_assertion",
+    "x_linear_signature",
+    "x_mailgun_signature",
+    "x_master_key",
+    "x_meili_api_key",
+    "x_ms_client_principal",
+    "x_ms_token_aad_access_token",
+    "x_ms_token_aad_id_token",
+    "x_ms_token_aad_refresh_token",
+    "x_nf_client_connection_ip",
+    "x_nomad_token",
+    "x_npm_token",
+    "x_original_authorization",
+    "x_real_ip",
+    "x_remote_email",
+    "x_remote_groups",
+    "x_remote_user",
+    "x_pagerduty_signature",
+    "x_parse_rest_api_key",
+    "x_sendgrid_event_webhook_signature",
+    "x_session_token",
+    "x_shopify_hmac_sha256",
+    "x_signature",
+    "x_signature_ed25519",
+    "x_slack_signature",
+    "x_sonarqube_passcode",
+    "x_squarespace_hmacsha256_signature",
+    "x_twilio_signature",
+    "x_typesense_api_key",
+    "x_userinfo",
+    "x_vault_token",
+    "x_vercel_oidc_token",
+    "x_webhook_signature",
+    "x_webhook_secret",
+    "x_wix_webhook_signature",
+    "x_xsrf_token",
+    "x_zendesk_webhook_signature",
+];
+exports.SENSITIVE_QUERY_KEYS = [
+    "access_token",
+    "api_key",
+    "api_secret",
+    "api_token",
+    "apikey",
+    "assertion",
+    "auth",
+    "auth_token",
+    "authorization",
+    "authorization_code",
+    "bearer_token",
+    "client_assertion",
+    "client_secret",
+    "code",
+    "code_verifier",
+    "credential",
+    "hmac",
+    "id_token",
+    "invite_token",
+    "jwt",
+    "key",
+    "magic_link_token",
+    "oauth_token_secret",
+    "otp",
+    "password_reset_token",
+    "password",
+    "policy",
+    "pin",
+    "refresh_token",
+    "reset_token",
+    "saml_response",
+    "secret",
+    "secret_key",
+    "session",
+    "session_id",
+    "session_token",
+    "sig",
+    "signature",
+    "token",
+    "token_secret",
+    "unsubscribe_token",
+    "verification_token",
+    "x_amz_credential",
+    "x_amz_security_token",
+    "x_amz_signature",
+    "x_goog_credential",
+    "x_goog_signature",
+];

package/dist/redaction.d.ts

@@ -0,0 +1,24 @@
+export interface RedactOptions {
+    readonly secrets?: readonly string[];
+    readonly pii?: readonly string[];
+}
+export interface RedactionConfig {
+    readonly secretKeys: ReadonlySet<string>;
+    readonly piiKeys: ReadonlySet<string>;
+}
+export type KeyMatchKind = "floor" | "pii" | "secret";
+export declare function setActiveRedactionConfig(config: RedactionConfig): void;
+export declare function getActiveRedactionConfig(): RedactionConfig;
+export declare function normalizeKey(key: string): string;
+export declare function isFloorKey(key: string): boolean;
+export declare function isSensitiveQueryKey(key: string): boolean;
+export declare function keyMatch(key: string, config?: RedactionConfig): KeyMatchKind | undefined;
+export declare function tailMask(value: unknown): string;
+export declare function maskForMatch(kind: KeyMatchKind, value: unknown): string;
+export declare function redactQueryPairs(query: string, config?: RedactionConfig): string;
+export declare function redactUrlLike(text: string, config?: RedactionConfig): string;
+export declare function redactString(text: string, config?: RedactionConfig): string;
+export declare function redactDeep(value: unknown, config?: RedactionConfig): unknown;
+export declare function redactAttributeValue(key: string, value: unknown, config?: RedactionConfig): unknown;
+export declare function redactAttributesCopy(attributes: Readonly<Record<string, unknown>>, config?: RedactionConfig): Record<string, unknown>;
+export declare function resolveRedactionConfig(redact: unknown): RedactionConfig;