@mastra/observability 1.16.6 → 1.17.0-alpha.1

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @mastra/observability
 
+## 1.17.0-alpha.1
+
+### Minor Changes
+
+- Added an `indexed` redaction style to `SensitiveDataFilter`. Instead of collapsing every sensitive value to the same `[REDACTED]` string, each unique value gets a stable token derived from the first matched field name, like `[APIKEY_1]`. ([#21328](https://github.com/mastra-ai/mastra/pull/21328))
+
+  ```ts
+  new SensitiveDataFilter({
+    redactionStyle: 'indexed',
+  });
+  ```
+
+  See [#21313](https://github.com/mastra-ai/mastra/issues/21313)
+
+### Patch Changes
+
+- Updated dependencies [[`898bba4`](https://github.com/mastra-ai/mastra/commit/898bba46d4806dd255a44e5dc3a3d5827eaefdfe), [`f9aab1c`](https://github.com/mastra-ai/mastra/commit/f9aab1cfc3fda03238a7fd7bd8b794e07497878c), [`e31421b`](https://github.com/mastra-ai/mastra/commit/e31421bc9c11c03c6e74f447ecb5820000e2b9d7), [`aece0e7`](https://github.com/mastra-ai/mastra/commit/aece0e7cb124ae1eb1230689b887f5554b9a0bf0)]:
+  - @mastra/core@1.59.0-alpha.2
+
+## 1.17.0-alpha.0
+
+### Minor Changes
+
+- Fixed traces that start under an external parent span not appearing in Mastra Studio. ([#20499](https://github.com/mastra-ai/mastra/pull/20499))
+
+### Patch Changes
+
+- Updated dependencies [[`088e41e`](https://github.com/mastra-ai/mastra/commit/088e41e434ed05f2c674b254f1034ec46a57a7be), [`b2f0013`](https://github.com/mastra-ai/mastra/commit/b2f0013375588d40c03c13e843b99c0ff8872ca5), [`3b541ae`](https://github.com/mastra-ai/mastra/commit/3b541ae5d410c52b80a7e381d84d021cddb9a449), [`ae79e34`](https://github.com/mastra-ai/mastra/commit/ae79e34c0bd8674fc24c7524217bfc4a051c6136), [`a6c4399`](https://github.com/mastra-ai/mastra/commit/a6c4399763590b3dae21a2c81826e89a3b1deee4)]:
+  - @mastra/core@1.59.0-alpha.0
+
 ## 1.16.6
 
 ### Patch Changes

package/dist/config.d.ts

@@ -278,6 +278,7 @@ export declare const observabilityRegistryConfigSchema: z.ZodObject<{
         redactionStyle: z.ZodOptional<z.ZodEnum<{
             full: "full";
             partial: "partial";
+            indexed: "indexed";
         }>>;
     }, z.core.$strict>]>>;
 }, z.core.$loose>;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EACV,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,QAAQ,EACR,eAAe,EAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAMpE;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAMD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAA;CAAE,CAAC;AAMhG;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,uBAAuB;IACvB,SAAS,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACpC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,oCAAoC;IACpC,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC7C,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC9B;;;;;;;;;;;;;;;;;OAiBG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC;IAChD;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,iGAAiG;QACjG,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,iFAAiF;QACjF,KAAK,CAAC,EAAE,QAAQ,CAAC;KAClB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,GAAG,qBAAqB,CAAC,CAAC;IAC5F,yEAAyE;IACzE,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,CAAC,EAAE,OAAO,GAAG,0BAA0B,CAAC;CAC5D;AAMD;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;mCAlJO,GAAG,EAAE,KAAK,OAAO,YAAjB,GAAG,EAAE,KAAK,OAAO;2BAiKzD,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;kBAO1B,CAAC;AAmCd;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;uCArNJ,GAAG,EAAE,KAAK,OAAO,YAAjB,GAAG,EAAE,KAAK,OAAO;;;;;;;oDAAjB,GAAG,EAAE,KAAK,OAAO,YAAjB,GAAG,EAAE,KAAK,OAAO;;;;;;;;;;;;;;;;;;;;;;;iBAoOxD,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;uCA1OD,GAAG,EAAE,KAAK,OAAO,YAAjB,GAAG,EAAE,KAAK,OAAO;;;;;;;oDAAjB,GAAG,EAAE,KAAK,OAAO,YAAjB,GAAG,EAAE,KAAK,OAAO;;;;;;;;;;;;;;;;;;;;;;iBAoP1D,CAAC;AAgBF,eAAO,MAAM,iCAAiC;;;;;wDApQJ,GAAG,EAAE,KAAK,OAAO,YAAjB,GAAG,EAAE,KAAK,OAAO;;;;;;;;;iBA0UxD,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EACV,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,QAAQ,EACR,eAAe,EAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAMpE;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAMD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAA;CAAE,CAAC;AAMhG;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,uBAAuB;IACvB,SAAS,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACpC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,oCAAoC;IACpC,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC7C,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC9B;;;;;;;;;;;;;;;;;OAiBG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC;IAChD;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,iGAAiG;QACjG,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,iFAAiF;QACjF,KAAK,CAAC,EAAE,QAAQ,CAAC;KAClB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,GAAG,qBAAqB,CAAC,CAAC;IAC5F,yEAAyE;IACzE,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,CAAC,EAAE,OAAO,GAAG,0BAA0B,CAAC;CAC5D;AAMD;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;mCAlJO,GAAG,EAAE,KAAK,OAAO,YAAjB,GAAG,EAAE,KAAK,OAAO;2BAiKzD,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;kBAO1B,CAAC;AAmCd;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;uCArNJ,GAAG,EAAE,KAAK,OAAO,YAAjB,GAAG,EAAE,KAAK,OAAO;;;;;;;oDAAjB,GAAG,EAAE,KAAK,OAAO,YAAjB,GAAG,EAAE,KAAK,OAAO;;;;;;;;;;;;;;;;;;;;;;;iBAoOxD,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;uCA1OD,GAAG,EAAE,KAAK,OAAO,YAAjB,GAAG,EAAE,KAAK,OAAO;;;;;;;oDAAjB,GAAG,EAAE,KAAK,OAAO,YAAjB,GAAG,EAAE,KAAK,OAAO;;;;;;;;;;;;;;;;;;;;;;iBAoP1D,CAAC;AAgBF,eAAO,MAAM,iCAAiC;;;;;wDApQJ,GAAG,EAAE,KAAK,OAAO,YAAjB,GAAG,EAAE,KAAK,OAAO;;;;;;;;;;iBA0UxD,CAAC"}

package/dist/index.cjs

@@ -35,6 +35,7 @@ path = __toESM(path, 1);
 let stream_web = require("stream/web");
 let _mastra_core_features = require("@mastra/core/features");
 let _mastra_core_storage = require("@mastra/core/storage");
+let crypto = require("crypto");
 //#region src/bus/route-event.ts
 /**
 * Route a single event to the appropriate method on a handler.
@@ -770,7 +771,11 @@ const observabilityConfigValueSchema = zod_v4.z.object(observabilityInstanceConf
 const sensitiveDataFilterOptionsSchema = zod_v4.z.object({
 	sensitiveFields: zod_v4.z.array(zod_v4.z.string()).optional(),
 	redactionToken: zod_v4.z.string().optional(),
-	redactionStyle: zod_v4.z.enum(["full", "partial"]).optional()
+	redactionStyle: zod_v4.z.enum([
+		"full",
+		"partial",
+		"indexed"
+	]).optional()
 }).strict();
 const observabilityRegistryConfigSchema = zod_v4.z.object({
 	default: zod_v4.z.object({ enabled: zod_v4.z.boolean().optional() }).optional().nullable(),
@@ -2541,8 +2546,10 @@ var BaseSpan = class {
 	entityId;
 	/** Entity name that created the span */
 	entityName;
-	/** Parent span ID (for root spans that are children of external spans) */
+	/** Parent span within this Mastra trace: a span Mastra created (the span-tree parent, or a prior Mastra span such as the suspended run a resume links back to) */
 	parentSpanId;
+	/** Parent from an external tracing system (ambient OTel / dd-trace span) that Mastra did not create; carried for external correlation, not part of Mastra's own parent/child linkage */
+	externalParentSpanId;
 	/** Deep clean options for serialization */
 	deepCleanOptions;
 	/**
@@ -2649,6 +2656,17 @@ var BaseSpan = class {
 		if (parentSpan) return parentSpan.id;
 		return this.parent.getParentSpanId(includeInternalSpans);
 	}
+	/**
+	* External (foreign tracing-system) parent id to export alongside
+	* {@link getParentSpanId}. When every Mastra ancestor is dropped from
+	* export, the span is exported at the root's position, so the root's
+	* external parent must travel with it.
+	*/
+	getExportedExternalParentSpanId(includeInternalSpans) {
+		if (!this.parent) return this.externalParentSpanId;
+		if (this.getParentSpan(includeInternalSpans)) return this.externalParentSpanId;
+		return this.parent.getExportedExternalParentSpanId(includeInternalSpans);
+	}
 	/** Find the closest parent span of a specific type by walking up the parent chain */
 	findParent(spanType) {
 		let current = this.parent;
@@ -2723,6 +2741,7 @@ var BaseSpan = class {
 			isEvent: this.isEvent,
 			isRootSpan: this.isRootSpan,
 			parentSpanId: this.getParentSpanId(includeInternalSpans),
+			externalParentSpanId: this.getExportedExternalParentSpanId(includeInternalSpans),
 			...this.isRootSpan && this.tags?.length ? { tags: this.tags } : {}
 		};
 	}
@@ -2765,6 +2784,7 @@ var DefaultSpan = class extends BaseSpan {
 			this.id = options.spanId;
 			this.traceId = options.traceId;
 			if (options.parentSpanId) this.parentSpanId = options.parentSpanId;
+			if (options.externalParentSpanId) this.externalParentSpanId = options.externalParentSpanId;
 			return;
 		}
 		const bridge = observabilityInstance.getBridge();
@@ -2773,7 +2793,8 @@ var DefaultSpan = class extends BaseSpan {
 			if (bridgeIds) {
 				this.id = bridgeIds.spanId;
 				this.traceId = bridgeIds.traceId;
-				this.parentSpanId = bridgeIds.parentSpanId;
+				this.parentSpanId = options.parentSpanId ?? bridgeIds.parentSpanId;
+				this.externalParentSpanId = options.externalParentSpanId ?? bridgeIds.externalParentSpanId;
 				return;
 			}
 		}
@@ -2787,6 +2808,8 @@ var DefaultSpan = class extends BaseSpan {
 		this.id = generateSpanId();
 		if (options.parentSpanId) if (isValidSpanId(options.parentSpanId)) this.parentSpanId = options.parentSpanId;
 		else console.error(`[Mastra Tracing] Invalid parentSpanId: must be 1-16 hexadecimal characters, got "${options.parentSpanId}". Ignoring.`);
+		if (options.externalParentSpanId) if (isValidSpanId(options.externalParentSpanId)) this.externalParentSpanId = options.externalParentSpanId;
+		else console.error(`[Mastra Tracing] Invalid externalParentSpanId: must be 1-16 hexadecimal characters, got "${options.externalParentSpanId}". Ignoring.`);
 	}
 	end(options) {
 		if (this.isEvent) return;
@@ -3035,11 +3058,13 @@ var BaseObservabilityInstance = class extends _mastra_core_base.MastraBase {
 		} : enrichedMetadata;
 		const tags = !options.parent ? tracingOptions?.tags : void 0;
 		const traceId = !options.parent ? options.traceId ?? tracingOptions?.traceId : options.traceId;
-		const parentSpanId = !options.parent ? options.parentSpanId ?? tracingOptions?.parentSpanId : options.parentSpanId;
+		const parentSpanId = options.parentSpanId;
+		const externalParentSpanId = !options.parent ? options.externalParentSpanId ?? tracingOptions?.parentSpanId : options.externalParentSpanId;
 		const span = this.createSpan({
 			...rest,
 			traceId,
 			parentSpanId,
+			externalParentSpanId,
 			metadata: finalMetadata,
 			traceState,
 			tags,
@@ -8728,13 +8753,26 @@ var ObservabilityRegistry = class {
 //#endregion
 //#region src/span_processors/sensitive-data-filter.ts
 /**
+* Maximum number of traces to keep indexed-redaction state for.
+* Spans never signal trace completion, so state is evicted least-recently-used.
+*/
+const MAX_TRACKED_TRACES = 1e3;
+/**
+* Maximum number of unique values tracked per trace for indexed redaction.
+* Once reached, new values fall back to the full redaction token while
+* already-tracked values keep their assigned tokens.
+*/
+const MAX_TRACKED_VALUES_PER_TRACE = 1e3;
+/**
 * SensitiveDataFilter
 *
 * An SpanOutputProcessor that redacts sensitive information from span fields.
 *
 * - Sensitive keys are matched case-insensitively, normalized to remove separators.
-* - Sensitive values are redacted using either full or partial redaction.
+* - Sensitive values are redacted using full, partial, or indexed redaction.
 * - Partial redaction always keeps 3 chars at the start and end.
+* - Indexed redaction assigns each unique value a stable `[LABEL_N]` token,
+*   consistent across all spans of a trace.
 * - JSON strings containing sensitive fields are parsed and redacted.
 * - If filtering a field fails, the field is replaced with:
 *   `{ error: { processor: "sensitive-data-filter" } }`
@@ -8744,6 +8782,7 @@ var SensitiveDataFilter = class {
 	sensitiveFields;
 	redactionToken;
 	redactionStyle;
+	traceStates = /* @__PURE__ */ new Map();
 	constructor(options = {}) {
 		this.sensitiveFields = (options.sensitiveFields || [
 			"password",
@@ -8773,42 +8812,63 @@ var SensitiveDataFilter = class {
 	* @returns A new span with sensitive values redacted
 	*/
 	process(span) {
-		span.attributes = this.tryFilter(span.attributes);
-		span.metadata = this.tryFilter(span.metadata);
-		span.input = this.tryFilter(span.input);
-		span.output = this.tryFilter(span.output);
-		span.errorInfo = this.tryFilter(span.errorInfo);
+		const indexedState = this.redactionStyle === "indexed" ? this.getTraceState(span.traceId) : void 0;
+		span.attributes = this.tryFilter(span.attributes, indexedState);
+		span.metadata = this.tryFilter(span.metadata, indexedState);
+		span.input = this.tryFilter(span.input, indexedState);
+		span.output = this.tryFilter(span.output, indexedState);
+		span.errorInfo = this.tryFilter(span.errorInfo, indexedState);
 		return span;
 	}
 	/**
+	* Get (or create) the indexed-redaction state for a trace.
+	* Uses the Map's insertion order as an LRU: accessed traces are re-inserted,
+	* and the least recently used trace is evicted once the cap is exceeded.
+	*/
+	getTraceState(traceId) {
+		let state = this.traceStates.get(traceId);
+		if (state) this.traceStates.delete(traceId);
+		else state = {
+			tokensByValue: /* @__PURE__ */ new Map(),
+			counters: /* @__PURE__ */ new Map()
+		};
+		this.traceStates.set(traceId, state);
+		while (this.traceStates.size > MAX_TRACKED_TRACES) {
+			const oldest = this.traceStates.keys().next().value;
+			if (oldest === void 0) break;
+			this.traceStates.delete(oldest);
+		}
+		return state;
+	}
+	/**
 	* Recursively filter objects/arrays for sensitive keys.
 	* Handles circular references by replacing with a marker.
 	* Also attempts to parse and redact JSON strings.
 	*/
-	deepFilter(obj, seen = /* @__PURE__ */ new WeakSet()) {
+	deepFilter(obj, seen = /* @__PURE__ */ new WeakSet(), indexedState) {
 		if (obj === null || typeof obj !== "object") {
 			if (typeof obj === "string") {
 				const trimmed = obj.trim();
-				if (trimmed.startsWith("{") || trimmed.startsWith("[")) return this.redactJsonString(obj);
+				if (trimmed.startsWith("{") || trimmed.startsWith("[")) return this.redactJsonString(obj, indexedState);
 			}
 			return obj;
 		}
 		if (seen.has(obj)) return "[Circular Reference]";
 		seen.add(obj);
 		if (obj instanceof Date) return obj;
-		if (Array.isArray(obj)) return obj.map((item) => this.deepFilter(item, seen));
+		if (Array.isArray(obj)) return obj.map((item) => this.deepFilter(item, seen, indexedState));
 		const filtered = {};
 		for (const key of Object.keys(obj)) {
 			const normKey = this.normalizeKey(key);
-			if (this.isSensitive(normKey)) if (obj[key] && typeof obj[key] === "object") filtered[key] = this.deepFilter(obj[key], seen);
-			else filtered[key] = this.redactValue(obj[key]);
-			else filtered[key] = this.deepFilter(obj[key], seen);
+			if (this.isSensitive(normKey)) if (obj[key] && typeof obj[key] === "object") filtered[key] = this.deepFilter(obj[key], seen, indexedState);
+			else filtered[key] = this.redactValue(obj[key], normKey, indexedState);
+			else filtered[key] = this.deepFilter(obj[key], seen, indexedState);
 		}
 		return filtered;
 	}
-	tryFilter(value) {
+	tryFilter(value, indexedState) {
 		try {
-			return this.deepFilter(value);
+			return this.deepFilter(value, /* @__PURE__ */ new WeakSet(), indexedState);
 		} catch {
 			return { error: { processor: this.name } };
 		}
@@ -8838,11 +8898,11 @@ var SensitiveDataFilter = class {
 	* Attempt to parse a string as JSON and redact sensitive fields within it.
 	* If parsing fails or no sensitive data is found, returns the original string.
 	*/
-	redactJsonString(str) {
+	redactJsonString(str, indexedState) {
 		try {
 			const parsed = JSON.parse(str);
 			if (parsed && typeof parsed === "object") {
-				const filtered = this.deepFilter(parsed, /* @__PURE__ */ new WeakSet());
+				const filtered = this.deepFilter(parsed, /* @__PURE__ */ new WeakSet(), indexedState);
 				return JSON.stringify(filtered);
 			}
 			return str;
@@ -8854,17 +8914,36 @@ var SensitiveDataFilter = class {
 	* Redact a sensitive value.
 	* - Full style: replaces with a fixed token.
 	* - Partial style: shows 3 chars at start and end, hides the middle.
+	* - Indexed style: replaces with a stable `[LABEL_N]` token, where the label
+	*   comes from the normalized field name and the same value always maps to
+	*   the same token within a trace.
 	*
-	* Non-string values are converted to strings before partial redaction.
-	*/
-	redactValue(value) {
-		if (this.redactionStyle === "full") return this.redactionToken;
-		const str = String(value);
-		const len = str.length;
-		if (len <= 6) return this.redactionToken;
-		return str.slice(0, 3) + "…" + str.slice(len - 3);
+	* Non-string values are converted to strings before partial or indexed redaction.
+	*/
+	redactValue(value, normKey, indexedState) {
+		if (this.redactionStyle === "partial") {
+			const str = String(value);
+			const len = str.length;
+			if (len <= 6) return this.redactionToken;
+			return str.slice(0, 3) + "…" + str.slice(len - 3);
+		}
+		if (this.redactionStyle === "indexed" && indexedState) {
+			const valueKey = (0, crypto.createHash)("sha256").update(String(value)).digest("hex");
+			const existing = indexedState.tokensByValue.get(valueKey);
+			if (existing) return existing;
+			if (indexedState.tokensByValue.size >= MAX_TRACKED_VALUES_PER_TRACE) return this.redactionToken;
+			const label = normKey.toUpperCase();
+			const count = (indexedState.counters.get(label) ?? 0) + 1;
+			indexedState.counters.set(label, count);
+			const token = `[${label}_${count}]`;
+			indexedState.tokensByValue.set(valueKey, token);
+			return token;
+		}
+		return this.redactionToken;
+	}
+	async shutdown() {
+		this.traceStates.clear();
 	}
-	async shutdown() {}
 };
 //#endregion
 //#region src/default.ts