@morsehq-dev/sdk 0.5.0 → 0.6.0-rc.1

package/dist/{chunk-ZIMGB7IT.js → chunk-HJV35HWL.js}

@@ -254,7 +254,7 @@ function redactValue(value, config, depth = 0) {
   }
   return value;
 }
-var PATTERN_ORDER, MANDATORY_PATTERNS, DEFAULT_OFF_PATTERNS, SHORT_KEYS, PATTERNS, EXTRA_PATTERN_CAP, EXTRA_PATTERN_CHAR_CAP, MAX_DEPTH;
+var PATTERN_ORDER, MANDATORY_PATTERNS, DEFAULT_OFF_PATTERNS, SHORT_KEYS, SECRET_ASSIGNMENT_SOURCE, PATTERNS, EXTRA_PATTERN_CAP, EXTRA_PATTERN_CHAR_CAP, MAX_DEPTH;
 var init_redaction = __esm({
   "src/_internal/redaction.ts"() {
     PATTERN_ORDER = [
@@ -265,7 +265,10 @@ var init_redaction = __esm({
       "phone_us",
       "phone_e164",
       "ssn_us",
-      "ip_address"
+      "ip_address",
+      // Last: the value-shaped patterns above are more specific, so a JWT inside
+      // `authorization: Bearer eyJ...` gets its own tag before this one runs.
+      "secret_assignment"
     ];
     MANDATORY_PATTERNS = /* @__PURE__ */ new Set([
       "api_key_prefixed",
@@ -282,8 +285,13 @@ var init_redaction = __esm({
       phone_us: "phone",
       phone_e164: "phone",
       ssn_us: "ssn",
-      ip_address: "ip"
+      ip_address: "ip",
+      secret_assignment: "secret"
+      // pragma: allowlist secret — a label, not a value
     };
+    SECRET_ASSIGNMENT_SOURCE = // Compound keys accept `=` or `:`; bare `secret` requires `=`, because with
+    // `:` it is more often a marker (`k8s-secret: mounted`) than an assignment.
+    `(?:(?:password|passwd|pwd|client[-_]?secret|secret[-_]?key|private[-_]?key|access[-_]?key|api[-_]?key|auth[-_]?token|access[-_]?token|refresh[-_]?token|id[-_]?token|session[-_]?token|authorization|credentials?)["']?\\s*[=:]|\\bsecret["']?\\s*=)\\s*(?:bearer\\s+)?(?:"[^"]*"|'[^']*'|\\S+)`;
     PATTERNS = {
       api_key_prefixed: new RegExp(
         "\\b(?:sk-[A-Za-z0-9_-]{20,}|sk_(?:live|test)_[A-Za-z0-9]{20,}|mhq_[A-Za-z0-9]{20,}|av_[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{36}|gho_[A-Za-z0-9]{36}|ghu_[A-Za-z0-9]{36}|ghs_[A-Za-z0-9]{36}|ghr_[A-Za-z0-9]{36}|xox[bopsa]-[0-9A-Za-z\\-]{10,}|(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA)[0-9A-Z]{16})\\b",
@@ -314,7 +322,17 @@ var init_redaction = __esm({
       ip_address: new RegExp(
         "\\b(?:(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(?:\\.(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}|(?:[A-F0-9]{1,4}:){2,7}[A-F0-9]{1,4})\\b",
         "gi"
-      )
+      ),
+      // MHQ-973 — key-context secret assignment. Every pattern above is
+      // VALUE-shaped: it recognises a credential by its own format. That cannot
+      // catch `password=hunter2` — `hunter2` is an ordinary word, and only the KEY
+      // marks it as a secret.
+      //
+      // Deliberately excludes a bare `token`: this is an LLM-observability SDK, and
+      // `input_tokens=100` / `max_tokens=4096` are core telemetry. Only unambiguous
+      // `*_token` compounds match. No leading `\\b` either, so `PGPASSWORD=` and
+      // `MYSQL_PWD=` are caught; the `[=:]` anchor is what prevents false positives.
+      secret_assignment: new RegExp(SECRET_ASSIGNMENT_SOURCE, "gi")
     };
     EXTRA_PATTERN_CAP = 10;
     EXTRA_PATTERN_CHAR_CAP = 256;
@@ -409,6 +427,7 @@ function redactedMessage(error) {
       const out = redactValue(raw, activeRedactionConfig);
       raw = typeof out === "string" ? out : String(out);
     }
+    raw = raw.replace(new RegExp(SECRET_ASSIGNMENT_SOURCE, "gi"), "[REDACTED:secret]");
   } catch {
     return "<redaction unavailable>";
   }
@@ -434,6 +453,7 @@ function recordDrop(reason, category, quantity = 1) {
     if (checkBucket(localLogBuckets, `drop:${key}`, LOCAL_LOG_LIMIT_PER_WINDOW, LOCAL_LOG_WINDOW_MS)) {
       console.warn(`morse: dropped ${quantity} ${category} (${reason}) \u2014 telemetry is being lost`);
     }
+    if (transmissionAllowed()) ensureTimer();
   } catch {
   }
 }
@@ -602,12 +622,12 @@ function _resetForTesting() {
   level = LEVEL_ERROR;
   activeRedactionConfig = null;
 }
-var SDK_VERSION, LEVEL_OFF, LEVEL_ERROR, LEVEL_DEBUG, VALID_LEVELS, level, RATE_WINDOW_MS, RATE_LIMIT_PER_WINDOW, RATE_LIMIT_PER_WINDOW_DEBUG, rateBuckets, LOCAL_LOG_WINDOW_MS, LOCAL_LOG_LIMIT_PER_WINDOW, localLogBuckets, MAX_STACK_ENTRIES, MAX_MESSAGE_CHARS, MAX_BATCH_EVENTS, ALLOWED_EXTRA_KEYS, DIAGNOSTICS_PATH, MAX_PENDING, FLUSH_INTERVAL_MS, BREAKER_THRESHOLD, BREAKER_COOLDOWN_MS, REASON_QUEUE_FULL, REASON_RETRY_EXHAUSTED, REASON_QUOTA_REJECTED, REASON_SHUTDOWN_DROP, counters, activeRedactionConfig, pending, timer, consecutiveFailures, breakerOpenUntil, reporting, MORSE_PATH_MARKERS, clientConfig;
+var SDK_VERSION, LEVEL_OFF, LEVEL_ERROR, LEVEL_DEBUG, VALID_LEVELS, level, RATE_WINDOW_MS, RATE_LIMIT_PER_WINDOW, RATE_LIMIT_PER_WINDOW_DEBUG, rateBuckets, LOCAL_LOG_WINDOW_MS, LOCAL_LOG_LIMIT_PER_WINDOW, localLogBuckets, MAX_STACK_ENTRIES, MAX_MESSAGE_CHARS, MAX_BATCH_EVENTS, ALLOWED_EXTRA_KEYS, DIAGNOSTICS_PATH, MAX_PENDING, FLUSH_INTERVAL_MS, BREAKER_THRESHOLD, BREAKER_COOLDOWN_MS, REASON_QUEUE_FULL, REASON_RETRY_EXHAUSTED, REASON_QUOTA_REJECTED, REASON_ENCODE_FAILED, REASON_SHUTDOWN_DROP, REASON_AUTH_REJECTED, REASON_ENDPOINT_REJECTED, REASON_SEND_FAILED, counters, activeRedactionConfig, pending, timer, consecutiveFailures, breakerOpenUntil, reporting, MORSE_PATH_MARKERS, clientConfig;
 var init_diagnostics = __esm({
   "src/_internal/diagnostics.ts"() {
     init_env();
     init_redaction();
-    SDK_VERSION = "0.5.0" ;
+    SDK_VERSION = "0.6.0-rc.1" ;
     LEVEL_OFF = "off";
     LEVEL_ERROR = "error";
     LEVEL_DEBUG = "debug";
@@ -638,7 +658,11 @@ var init_diagnostics = __esm({
     REASON_QUEUE_FULL = "queue_full";
     REASON_RETRY_EXHAUSTED = "retry_exhausted";
     REASON_QUOTA_REJECTED = "quota_rejected";
+    REASON_ENCODE_FAILED = "encode_failed";
     REASON_SHUTDOWN_DROP = "shutdown_drop";
+    REASON_AUTH_REJECTED = "auth_rejected";
+    REASON_ENDPOINT_REJECTED = "endpoint_rejected";
+    REASON_SEND_FAILED = "send_failed";
     counters = /* @__PURE__ */ new Map();
     activeRedactionConfig = null;
     pending = [];
@@ -706,7 +730,10 @@ var init_spans = __esm({
       // MHQ-482: matches Python's `SpanType.RETRIEVER` (apps/sdk/python/src/morse_ai/spans.py).
       // @beta — retriever span type is subject to change before SDK v1.0 (see
       // the plain-LangChain adapter's on_retriever_* callbacks in src/langchain/).
-      RETRIEVER: "retriever"
+      RETRIEVER: "retriever",
+      // MHQ-1025: matches Python's `SpanType.HANDOFF`. One span per routing
+      // decision between two agents, with `from_agent` / `to_agent` metadata.
+      HANDOFF: "handoff"
     };
   }
 });
@@ -781,6 +808,14 @@ function redactAttrValue(value, config) {
   }
   return value;
 }
+function dropReasonForExportError(error) {
+  const code = error?.code;
+  if (typeof code !== "number") return REASON_RETRY_EXHAUSTED;
+  if (code === 429) return REASON_QUOTA_REJECTED;
+  if (code === 401 || code === 403) return REASON_AUTH_REJECTED;
+  if (code >= 400 && code < 500) return REASON_ENDPOINT_REJECTED;
+  return REASON_SEND_FAILED;
+}
 function getEngine() {
   if (engine === null) engine = new OtelEngine();
   return engine;
@@ -788,7 +823,7 @@ function getEngine() {
 function spanDictToOtelAttributes(spanDict, traceDict, resourceDict, opts) {
   const attrs = {};
   const spanType = spanDict.type;
-  if (typeof spanType === "string" && spanType) attrs["av.span_type"] = spanType;
+  if (typeof spanType === "string" && spanType) attrs["morse.span_type"] = spanType;
   const model = spanDict.model;
   if (model !== void 0 && model !== null) attrs["gen_ai.request.model"] = String(model);
   const tokenFields = [
@@ -807,12 +842,12 @@ function spanDictToOtelAttributes(spanDict, traceDict, resourceDict, opts) {
   }
   const costUsd = spanDict.cost_usd;
   if (costUsd !== void 0 && costUsd !== null) {
-    attrs["av.cost_usd"] = String(costUsd);
+    attrs["morse.cost_usd"] = String(costUsd);
   }
   for (const [src, otelKey] of [
-    ["input_data", "av.input_data"],
-    ["output_data", "av.output_data"],
-    ["context_segments", "av.context_segments"]
+    ["input_data", "morse.input_data"],
+    ["output_data", "morse.output_data"],
+    ["context_segments", "morse.context_segments"]
   ]) {
     const v = spanDict[src];
     if (v !== void 0 && v !== null) {
@@ -824,35 +859,36 @@ function spanDictToOtelAttributes(spanDict, traceDict, resourceDict, opts) {
   if (metadata && typeof metadata === "object") {
     for (const [key, value] of Object.entries(metadata)) {
       const encoded = jsonCapped(value, opts.maxFieldBytes);
-      if (encoded !== null) attrs[`av.metadata.${key}`] = encoded;
+      if (encoded !== null) attrs[`morse.metadata.${key}`] = encoded;
     }
   }
   const errorMessage = spanDict.error_message;
   if (opts.isRoot) {
     const threadId = traceDict.thread_id;
-    if (threadId !== void 0 && threadId !== null) attrs["av.thread_id"] = String(threadId);
+    if (threadId !== void 0 && threadId !== null) attrs["morse.thread_id"] = String(threadId);
     const userId = traceDict.user_id;
-    if (userId !== void 0 && userId !== null) attrs["av.user_id"] = String(userId);
+    if (userId !== void 0 && userId !== null) attrs["morse.user_id"] = String(userId);
     const userMetadata = traceDict.user_metadata;
     if (userMetadata && typeof userMetadata === "object") {
       const entries = Object.entries(userMetadata);
       if (entries.length > 0) {
-        attrs["av.user_metadata"] = JSON.stringify(
+        attrs["morse.user_metadata"] = JSON.stringify(
           Object.fromEntries(entries.map(([k, v]) => [k, String(v)]))
         );
       }
     }
     const success = traceDict.success;
-    if (success !== void 0 && success !== null) attrs["av.outcome.success"] = Boolean(success);
+    if (success !== void 0 && success !== null)
+      attrs["morse.outcome.success"] = Boolean(success);
     const outcome = traceDict.outcome;
-    if (outcome !== void 0 && outcome !== null) attrs["av.outcome.label"] = String(outcome);
+    if (outcome !== void 0 && outcome !== null) attrs["morse.outcome.label"] = String(outcome);
     const framework = resourceDict["morse_ai.framework"];
-    if (typeof framework === "string" && framework) attrs["av.framework"] = framework;
+    if (typeof framework === "string" && framework) attrs["morse.framework"] = framework;
     const source = resourceDict["morse_ai.source"];
-    if (typeof source === "string" && source) attrs["av.source"] = source;
+    if (typeof source === "string" && source) attrs["morse.source"] = source;
   }
   if (errorMessage && spanDict.status === "failed") {
-    attrs["av.error_message"] = String(errorMessage);
+    attrs["morse.error_message"] = String(errorMessage);
   }
   return attrs;
 }
@@ -944,7 +980,7 @@ function reportSwallowed(err, fingerprint) {
   } catch {
   }
 }
-var INSTRUMENTATION_NAME, DEFAULT_MAX_FIELD_BYTES, TRUNCATION_MARKER, contextManagerRegistered, MAX_U64, RedactingSpanExporter, RecordingSpanExporter, ResultCapturingExporter, OtelEngine, engine;
+var INSTRUMENTATION_NAME, DEFAULT_MAX_FIELD_BYTES, TRUNCATION_MARKER, contextManagerRegistered, MAX_U64, RedactingSpanExporter, DropReportingExporter, RecordingSpanExporter, ResultCapturingExporter, OtelEngine, engine;
 var init_otel_provider = __esm({
   "src/_internal/otel-provider.ts"() {
     init_diagnostics();
@@ -981,6 +1017,29 @@ var init_otel_provider = __esm({
         return this.inner.forceFlush ? this.inner.forceFlush() : Promise.resolve();
       }
     };
+    DropReportingExporter = class {
+      constructor(inner) {
+        this.inner = inner;
+      }
+      inner;
+      export(spans, resultCallback) {
+        this.inner.export(spans, (result) => {
+          if (result.code === ExportResultCode.FAILED) {
+            try {
+              recordDrop(dropReasonForExportError(result.error), "span", spans.length);
+            } catch {
+            }
+          }
+          resultCallback(result);
+        });
+      }
+      shutdown() {
+        return this.inner.shutdown();
+      }
+      forceFlush() {
+        return this.inner.forceFlush ? this.inner.forceFlush() : Promise.resolve();
+      }
+    };
     RecordingSpanExporter = class {
       spans = [];
       export(spans, resultCallback) {
@@ -1047,7 +1106,10 @@ var init_otel_provider = __esm({
           compression: CompressionAlgorithm.GZIP,
           timeoutMillis: opts.timeoutMillis
         });
-        let exporter = new RedactingSpanExporter(otlpExporter, opts.redactionConfig);
+        let exporter = new RedactingSpanExporter(
+          new DropReportingExporter(otlpExporter),
+          opts.redactionConfig
+        );
         if (opts.resultSink) {
           exporter = new ResultCapturingExporter(exporter, opts.resultSink);
         }
@@ -1465,6 +1527,18 @@ function setContext(dims) {
   if (state.userMetadata === void 0) state.userMetadata = {};
   Object.assign(state.userMetadata, coerceDims(dims, "morse.tracing.set_context"));
 }
+function adoptThreadId(value) {
+  const state = getActiveTraceState();
+  if (state === null || state.threadId !== void 0 || value === null || value === void 0) {
+    return;
+  }
+  try {
+    const s = String(value);
+    if (s !== "") state.threadId = s;
+  } catch (err) {
+    report(err, { fingerprint: "morse.tracing.adopt_thread_id" });
+  }
+}
 function coerceDims(dims, fingerprint) {
   const out = {};
   for (const k of Object.keys(dims)) {
@@ -1665,6 +1739,6 @@ var init_propagation = __esm({
   }
 });
 
-export { DEFAULT_ENDPOINT, REASON_QUEUE_FULL, REASON_QUOTA_REJECTED, REASON_RETRY_EXHAUSTED, REASON_SHUTDOWN_DROP, SpanType, W3C_TRACEPARENT_HEADER, _resetForTesting, _resetForTesting2, buildRedactionConfig, buildTraceEntry, extractTraceparent, flushOnce, formatTraceparent, generateSpanId, generateTraceId, getActiveTraceState, getApiKey, getEndpoint, getEngine, getFlushIntervalSeconds, getInternalSource, getLastTrace, getMaxBatchSize, getMaxFieldBytes, getMaxQueueSize, getRedactionConfig, getSampleRate, getTransport, init_diagnostics, init_env, init_otel_provider, init_propagation, init_redaction, init_spans, init_tracing, injectIntoRequestInit, injectTraceparent, isAutoDetectDisabled, isDbCaptureEnabled, isDisabled, isValidInternalSource, nowIso, recordDrop, redactValue, report, runAsync, runSync, sendTrace, setContext, setDiagnosticsClientConfig, setLevel, setRedactionConfig2 as setRedactionConfig, setSource, setTransport, spanAsync, spanSync, startSpan };
-//# sourceMappingURL=chunk-ZIMGB7IT.js.map
-//# sourceMappingURL=chunk-ZIMGB7IT.js.map
+export { DEFAULT_ENDPOINT, REASON_AUTH_REJECTED, REASON_ENCODE_FAILED, REASON_ENDPOINT_REJECTED, REASON_QUEUE_FULL, REASON_QUOTA_REJECTED, REASON_RETRY_EXHAUSTED, REASON_SEND_FAILED, REASON_SHUTDOWN_DROP, SpanType, W3C_TRACEPARENT_HEADER, _resetForTesting, _resetForTesting2, adoptThreadId, buildRedactionConfig, buildTraceEntry, extractTraceparent, flushOnce, formatTraceparent, generateSpanId, generateTraceId, getActiveTraceState, getApiKey, getEndpoint, getEngine, getFlushIntervalSeconds, getInternalSource, getLastTrace, getMaxBatchSize, getMaxFieldBytes, getMaxQueueSize, getRedactionConfig, getSampleRate, getTransport, init_diagnostics, init_env, init_otel_provider, init_propagation, init_redaction, init_spans, init_tracing, injectIntoRequestInit, injectTraceparent, isAutoDetectDisabled, isDbCaptureEnabled, isDisabled, isValidInternalSource, nowIso, recordDrop, redactValue, report, runAsync, runSync, sendTrace, setContext, setDiagnosticsClientConfig, setLevel, setRedactionConfig2 as setRedactionConfig, setSource, setTransport, spanAsync, spanSync, startSpan };
+//# sourceMappingURL=chunk-HJV35HWL.js.map
+//# sourceMappingURL=chunk-HJV35HWL.js.map