@ogcio/o11y-sdk-react 0.3.0 → 0.4.2

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [0.4.2](https://github.com/ogcio/o11y/compare/@ogcio/o11y-sdk-react@v0.4.0...@ogcio/o11y-sdk-react@v0.4.2) (2025-09-09)
+
+### Miscellaneous Chores
+
+* **sdk-react:** propagate url encoding detection to react-sdk AB[#30758](https://github.com/ogcio/o11y/issues/30758) ([#202](https://github.com/ogcio/o11y/issues/202)) ([aaf0d5a](https://github.com/ogcio/o11y/commit/aaf0d5a9b30a186d804fc839a23180891d9ef883))
+
+## [0.4.0](https://github.com/ogcio/o11y/compare/@ogcio/o11y-sdk-react@v0.3.0...@ogcio/o11y-sdk-react@v0.4.0) (2025-09-02)
+
+
+### Features
+
+* o11y react-sdk IP pii redaction AB[#30758](https://github.com/ogcio/o11y/issues/30758) ([#196](https://github.com/ogcio/o11y/issues/196)) ([d6bb83f](https://github.com/ogcio/o11y/commit/d6bb83fa425ffdf3fb023ec62caeef070995d07a))
+
+
+### Miscellaneous Chores
+
+* **deps:** bump the root-deps group across 1 directory with 16 updates ([#193](https://github.com/ogcio/o11y/issues/193)) ([c523565](https://github.com/ogcio/o11y/commit/c523565a6ba7f327473e8d93afc7d532ac220457))
+* **deps:** bump the root-deps group across 3 directories with 34 updates ([#188](https://github.com/ogcio/o11y/issues/188)) ([c0059f3](https://github.com/ogcio/o11y/commit/c0059f33cbb5c39cf6df0f4640604796dbbd3f57))
+
 ## [0.3.0](https://github.com/ogcio/o11y/compare/@ogcio/o11y-sdk-react@v0.2.0...@ogcio/o11y-sdk-react@v0.3.0) (2025-07-31)
 
 

package/dist/lib/index.d.ts

@@ -38,10 +38,15 @@ export interface FaroSDKConfig extends SDKConfig {
      */
     detection?: {
         /**
-         * Redact email address
+         * Redact email addresses
          * @default true
          */
         email?: boolean;
+        /**
+         * Redact ip addresses
+         * @default true
+         */
+        ip?: boolean;
     };
 }
 export type SDKCollectorMode = "single" | "batch";

package/dist/lib/instrumentation.faro.js

@@ -6,6 +6,7 @@ import { DocumentLoadInstrumentation } from "@opentelemetry/instrumentation-docu
 import { FetchInstrumentation } from "@opentelemetry/instrumentation-fetch";
 import { UserInteractionInstrumentation } from "@opentelemetry/instrumentation-user-interaction";
 import { _beforeSend } from "./internals/hooks.js";
+import { redactors, } from "./internals/redaction/redactors/index.js";
 export default function buildFaroInstrumentation(config) {
     if (!config) {
         console.warn("observability config not set. Skipping Faro OpenTelemetry instrumentation.");
@@ -19,14 +20,11 @@ export default function buildFaroInstrumentation(config) {
         console.error("collectorUrl does not use a valid format. Skipping Faro OpenTelemetry instrumentation.");
         return;
     }
-    if (!config.detection) {
-        config.detection = {
-            email: true,
-        };
-    }
-    if (config.detection.email === undefined) {
-        config.detection.email = true;
-    }
+    const redactorsChain = Object.entries(redactors)
+        .filter(([key]) => {
+        return config.detection?.[key] !== false;
+    })
+        .map(([_, value]) => value);
     try {
         diag.setLogger(new DiagConsoleLogger(), config.diagLogLevel
             ? DiagLogLevel[config.diagLogLevel]
@@ -39,7 +37,7 @@ export default function buildFaroInstrumentation(config) {
             batching: {
                 enabled: !(config.collectorMode === "single"),
             },
-            beforeSend: config.detection.email ? _beforeSend : undefined,
+            beforeSend: _beforeSend(redactorsChain),
             instrumentations: [
                 ...getWebInstrumentations({
                     captureConsole: true,

package/dist/lib/internals/hooks.d.ts

@@ -1,2 +1,3 @@
 import { APIEvent, TransportItem } from "@grafana/faro-web-sdk";
-export declare function _beforeSend(item: TransportItem<APIEvent>): TransportItem<APIEvent> | null;
+import { Redactor } from "./redaction/redactors/index.js";
+export declare const _beforeSend: (redactors: Redactor[]) => (item: TransportItem<APIEvent>) => TransportItem<APIEvent> | null;

package/dist/lib/internals/hooks.js

@@ -1,32 +1,34 @@
-import { _cleanStringPII } from "./pii-detection.js";
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function _cleanObjectPII(data, type) {
+import { _cleanStringPII } from "./redaction/pii-detection.js";
+function _cleanObjectPII(data, type, redactors) {
     if (!data) {
         return;
     }
     if (Array.isArray(data)) {
         data.forEach((item, index) => {
             if (typeof item === "string") {
-                data[index] = _cleanStringPII(data[index], type);
+                data[index] = _cleanStringPII(data[index], type, redactors);
                 return;
             }
             if (typeof item === "object") {
-                _cleanObjectPII(item, type);
+                _cleanObjectPII(item, type, redactors);
             }
         });
     }
     if (typeof data === "object") {
         for (const key in data) {
             if (typeof data[key] === "string") {
-                data[key] = _cleanStringPII(data[key], type);
+                data[key] = _cleanStringPII(data[key], type, redactors);
             }
             if (typeof data[key] === "object") {
-                _cleanObjectPII(data[key], type);
+                _cleanObjectPII(data[key], type, redactors);
             }
         }
     }
 }
-export function _beforeSend(item) {
-    _cleanObjectPII(item, item.type);
+export const _beforeSend = (redactors) => (item) => {
+    if (redactors.length === 0) {
+        return item;
+    }
+    _cleanObjectPII(item, item.type, redactors);
     return item;
-}
+};

package/dist/lib/internals/redaction/pii-detection.d.ts

@@ -0,0 +1,26 @@
+import { TransportItemType } from "@grafana/faro-web-sdk";
+import { Redactor } from "./redactors/index.js";
+/**
+ * Checks whether a string contains URI-encoded components.
+ *
+ * @param {string} value - The string to inspect.
+ * @returns {boolean} `true` if the string is encoded, `false` otherwise.
+ */
+export declare function _containsEncodedComponents(value: string): boolean;
+/**
+ * Cleans a string by redacting configured PIIs and emitting metrics for redacted values.
+ *
+ * If the string is URL-encoded, it will be decoded before redaction.
+ * Metrics are emitted for:
+ * - each domain found in redacted email addresses.
+ * - IPv4|IPv6 addresses redacted.
+ *
+ * @template T
+ *
+ * @param {string} value - The input value to sanitize.
+ * @param {"trace" | "log"} source - The source context of the input, used in metrics.
+ * @param {Redactor[]} redactors - The string processors containing the redaction logic.
+ *
+ * @returns {T} The cleaned string with any configured PII replaced by `[REDACTED PII_TYPE]`.
+ */
+export declare function _cleanStringPII(value: string, source: TransportItemType, redactors: Redactor[]): string;

package/dist/lib/internals/redaction/pii-detection.js

@@ -0,0 +1,47 @@
+/**
+ * Checks whether a string contains URI-encoded components.
+ *
+ * @param {string} value - The string to inspect.
+ * @returns {boolean} `true` if the string is encoded, `false` otherwise.
+ */
+export function _containsEncodedComponents(value) {
+    try {
+        const decodedURIComponent = decodeURIComponent(value);
+        if (decodeURI(value) !== decodedURIComponent) {
+            return true;
+        }
+        if (value !== decodedURIComponent) {
+            return (encodeURIComponent(decodedURIComponent) === value ||
+                encodeURI(decodedURIComponent) === value);
+        }
+    }
+    catch {
+        return false;
+    }
+    return false;
+}
+/**
+ * Cleans a string by redacting configured PIIs and emitting metrics for redacted values.
+ *
+ * If the string is URL-encoded, it will be decoded before redaction.
+ * Metrics are emitted for:
+ * - each domain found in redacted email addresses.
+ * - IPv4|IPv6 addresses redacted.
+ *
+ * @template T
+ *
+ * @param {string} value - The input value to sanitize.
+ * @param {"trace" | "log"} source - The source context of the input, used in metrics.
+ * @param {Redactor[]} redactors - The string processors containing the redaction logic.
+ *
+ * @returns {T} The cleaned string with any configured PII replaced by `[REDACTED PII_TYPE]`.
+ */
+export function _cleanStringPII(value, source, redactors) {
+    let kind = "string";
+    let decodedValue = value;
+    if (_containsEncodedComponents(value)) {
+        decodedValue = decodeURIComponent(value);
+        kind = "url";
+    }
+    return redactors.reduce((redactedValue, currentRedactor) => currentRedactor(redactedValue, source, kind), decodedValue);
+}

package/dist/lib/internals/redaction/redactors/email.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Redacts provided input and collects metadata metrics about redacted email domains,
+ * data source and kind.
+ *
+ * @param {string} value The input string potentially containing email addresses.
+ * @returns {string} the redacted value
+ */
+export declare const emailRedactor: (value: string, source: string, kind: string) => string;

package/dist/lib/internals/{pii-detection.js → redaction/redactors/email.js}

@@ -1,5 +1,5 @@
 import { faro } from "@grafana/faro-web-sdk";
-const EMAIL_REGEX = /[a-zA-Z0-9._%+-]+@([a-zA-Z0-9.-]+\.[a-z]{2,})/gi;
+const EMAIL_REGEX = /[\p{L}\p{N}._%+-]+@((?:[\p{L}\p{N}-]+\.)+[\p{L}]{2,})/giu;
 /**
  * Redacts all email addresses in the input string and collects metadata.
  *
@@ -26,37 +26,14 @@ function _redactEmails(value) {
     return { redacted, count, domains };
 }
 /**
- * Checks whether a string contains URI-encoded components.
+ * Redacts provided input and collects metadata metrics about redacted email domains,
+ * data source and kind.
  *
- * @param {string} value - The string to inspect.
- * @returns {boolean} `true` if the string is encoded, `false` otherwise.
- */
-function _containsEncodedComponents(value) {
-    try {
-        return decodeURI(value) !== decodeURIComponent(value);
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Cleans a string by redacting email addresses and emitting metrics for PII.
- *
- * If the string is URL-encoded, it will be decoded before redaction.
- * Metrics are emitted for each domain found in redacted email addresses.
- *
- * @param {string} value - The input string to sanitize.
- * @param {TransportItemType} source - The source context of the input.
- * @returns {string} The cleaned string with any email addresses replaced by `[REDACTED EMAIL]`.
+ * @param {string} value The input string potentially containing email addresses.
+ * @returns {string} the redacted value
  */
-export function _cleanStringPII(value, source) {
-    let kind = "string";
-    let decodedValue = value;
-    if (_containsEncodedComponents(value)) {
-        decodedValue = decodeURIComponent(value);
-        kind = "url";
-    }
-    const { redacted, count, domains } = _redactEmails(decodedValue);
+export const emailRedactor = (value, source, kind) => {
+    const { redacted, count, domains } = _redactEmails(value);
     if (count > 0) {
         for (const [domain, domainCount] of Object.entries(domains)) {
             faro.api.pushMeasurement({
@@ -75,4 +52,4 @@ export function _cleanStringPII(value, source) {
         }
     }
     return redacted;
-}
+};

package/dist/lib/internals/redaction/redactors/index.d.ts

@@ -0,0 +1,4 @@
+import { type FaroSDKConfig } from "../../../index.js";
+export type Redactor = (value: string, source: string, kind: string) => string;
+export type RedactorKeys = keyof NonNullable<FaroSDKConfig["detection"]>;
+export declare const redactors: Record<RedactorKeys, Redactor>;

package/dist/lib/internals/redaction/redactors/index.js

@@ -0,0 +1,6 @@
+import { emailRedactor } from "./email.js";
+import { ipRedactor } from "./ip.js";
+export const redactors = {
+    email: emailRedactor,
+    ip: ipRedactor,
+};

package/dist/lib/internals/redaction/redactors/ip.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Redacts provided input and collects metadata metrics about redacted IPs,
+ * data source and kind.
+ *
+ * @param {string} value The input string potentially containing IP addresses.
+ * @param {string} source The source of the attribute being redacted (log, span, metric).
+ * @param {string} kind The type of the data structure containing the PII
+ * @returns {string} the redacted value
+ */
+export declare const ipRedactor: (value: string, source: string, kind: string) => string;

package/dist/lib/internals/redaction/redactors/ip.js

@@ -0,0 +1,61 @@
+import { faro } from "@grafana/faro-web-sdk";
+// Generous IP address matchers (might match some invalid addresses like 192.168.01.1)
+const IPV4_REGEX = /(?<!\d)(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}(?!\d)/gi;
+const IPV6_REGEX = /(?<![0-9a-f:])((?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|:(?::[0-9A-Fa-f]{1,4}){1,7}|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?::[0-9A-Fa-f]{1,4}){1,6}|:(?::[0-9A-Fa-f]{1,4}){1,7}:?|(?:[0-9A-Fa-f]{1,4}:){1,4}:(?:25[0-5]|2[0-4]\d|1\d\d|\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|\d{1,2})){3})(?![0-9a-f:])/gi;
+/**
+ * Redacts all ip addresses in the input string and collects metadata.
+ *
+ * @param {string} value The input string potentially containing ip addresses.
+ * @returns {{
+ *   redacted: string,
+ *   count: number,
+ *   domains: Record<string, number>
+ * }}
+ *
+ * An object containing:
+ *   - `redacted`: the string with IP addresses replaced by `[REDACTED IPV*]`
+ *   - `counters`: total number of addresses redacted by IPv* type
+ *   - `domains`: a map of domain names to the number of times they were redacted
+ */
+function _redactIps(value) {
+    const counters = {};
+    const redacted = value
+        .replace(IPV4_REGEX, () => {
+        counters["IPv4"] = (counters["IPv4"] || 0) + 1;
+        return "[REDACTED IPV4]";
+    })
+        .replace(IPV6_REGEX, () => {
+        counters["IPv4"] = (counters["IPv4"] || 0) + 1;
+        return "[REDACTED IPV6]";
+    });
+    return { redacted, counters };
+}
+/**
+ * Redacts provided input and collects metadata metrics about redacted IPs,
+ * data source and kind.
+ *
+ * @param {string} value The input string potentially containing IP addresses.
+ * @param {string} source The source of the attribute being redacted (log, span, metric).
+ * @param {string} kind The type of the data structure containing the PII
+ * @returns {string} the redacted value
+ */
+export const ipRedactor = (value, source, kind) => {
+    const { redacted, counters } = _redactIps(value);
+    Object.entries(counters).forEach(([type, counter]) => {
+        if (counter > 0) {
+            faro.api.pushMeasurement({
+                type: "faro_o11y_pii_redaction",
+                values: {
+                    redacted: counter,
+                },
+            }, {
+                context: {
+                    pii_type: type,
+                    redaction_source: source,
+                    pii_format: kind,
+                },
+            });
+        }
+    });
+    return redacted;
+};

package/lib/index.ts

@@ -39,10 +39,15 @@ export interface FaroSDKConfig extends SDKConfig {
    */
   detection?: {
     /**
-     * Redact email address
+     * Redact email addresses
      * @default true
      */
     email?: boolean;
+    /**
+     * Redact ip addresses
+     * @default true
+     */
+    ip?: boolean;
   };
 }
 

package/lib/instrumentation.faro.ts

@@ -13,6 +13,10 @@ import { FetchInstrumentation } from "@opentelemetry/instrumentation-fetch";
 import { UserInteractionInstrumentation } from "@opentelemetry/instrumentation-user-interaction";
 import type { FaroSDKConfig } from "./index.js";
 import { _beforeSend } from "./internals/hooks.js";
+import {
+  RedactorKeys,
+  redactors,
+} from "./internals/redaction/redactors/index.js";
 
 export default function buildFaroInstrumentation(
   config?: FaroSDKConfig,
@@ -38,16 +42,11 @@ export default function buildFaroInstrumentation(
     return;
   }
 
-  if (!config.detection) {
-    config.detection = {
-      email: true,
-    };
-  }
-
-  if (config.detection.email === undefined) {
-    config.detection.email = true;
-  }
-
+  const redactorsChain = Object.entries(redactors)
+    .filter(([key]) => {
+      return config.detection?.[key as RedactorKeys] !== false;
+    })
+    .map(([_, value]) => value);
   try {
     diag.setLogger(
       new DiagConsoleLogger(),
@@ -64,7 +63,7 @@ export default function buildFaroInstrumentation(
       batching: {
         enabled: !(config.collectorMode === "single"),
       },
-      beforeSend: config.detection.email ? _beforeSend : undefined,
+      beforeSend: _beforeSend(redactorsChain),
       instrumentations: [
         ...getWebInstrumentations({
           captureConsole: true,

package/lib/internals/hooks.ts

@@ -3,10 +3,12 @@ import {
   TransportItem,
   TransportItemType,
 } from "@grafana/faro-web-sdk";
-import { _cleanStringPII } from "./pii-detection.js";
+import { _cleanStringPII } from "./redaction/pii-detection.js";
+import { Redactor } from "./redaction/redactors/index.js";
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function _cleanObjectPII(data: any, type: TransportItemType) {
+function _cleanObjectPII<
+  T extends string | Record<string, unknown> | unknown[] | unknown,
+>(data: T, type: TransportItemType, redactors: Redactor[]): void {
   if (!data) {
     return;
   }
@@ -14,12 +16,12 @@ function _cleanObjectPII(data: any, type: TransportItemType) {
   if (Array.isArray(data)) {
     data.forEach((item, index) => {
       if (typeof item === "string") {
-        data[index] = _cleanStringPII(data[index], type);
+        data[index] = _cleanStringPII(data[index], type, redactors);
         return;
       }
 
       if (typeof item === "object") {
-        _cleanObjectPII(item, type);
+        _cleanObjectPII<T>(item, type, redactors);
       }
     });
   }
@@ -27,19 +29,27 @@ function _cleanObjectPII(data: any, type: TransportItemType) {
   if (typeof data === "object") {
     for (const key in data) {
       if (typeof data[key] === "string") {
-        data[key] = _cleanStringPII(data[key], type);
+        data[key] = _cleanStringPII(
+          data[key],
+          type,
+          redactors,
+        ) as (typeof data)[typeof key];
       }
 
       if (typeof data[key] === "object") {
-        _cleanObjectPII(data[key], type);
+        _cleanObjectPII(data[key], type, redactors);
       }
     }
   }
 }
 
-export function _beforeSend(
-  item: TransportItem<APIEvent>,
-): TransportItem<APIEvent> | null {
-  _cleanObjectPII(item, item.type);
-  return item;
-}
+export const _beforeSend =
+  (redactors: Redactor[]) =>
+  (item: TransportItem<APIEvent>): TransportItem<APIEvent> | null => {
+    if (redactors.length === 0) {
+      return item;
+    }
+
+    _cleanObjectPII(item, item.type, redactors);
+    return item;
+  };

package/lib/internals/redaction/pii-detection.ts

@@ -0,0 +1,64 @@
+import { TransportItemType } from "@grafana/faro-web-sdk";
+import { Redactor } from "./redactors/index.js";
+
+/**
+ * Checks whether a string contains URI-encoded components.
+ *
+ * @param {string} value - The string to inspect.
+ * @returns {boolean} `true` if the string is encoded, `false` otherwise.
+ */
+export function _containsEncodedComponents(value: string): boolean {
+  try {
+    const decodedURIComponent = decodeURIComponent(value);
+    if (decodeURI(value) !== decodedURIComponent) {
+      return true;
+    }
+
+    if (value !== decodedURIComponent) {
+      return (
+        encodeURIComponent(decodedURIComponent) === value ||
+        encodeURI(decodedURIComponent) === value
+      );
+    }
+  } catch {
+    return false;
+  }
+
+  return false;
+}
+
+/**
+ * Cleans a string by redacting configured PIIs and emitting metrics for redacted values.
+ *
+ * If the string is URL-encoded, it will be decoded before redaction.
+ * Metrics are emitted for:
+ * - each domain found in redacted email addresses.
+ * - IPv4|IPv6 addresses redacted.
+ *
+ * @template T
+ *
+ * @param {string} value - The input value to sanitize.
+ * @param {"trace" | "log"} source - The source context of the input, used in metrics.
+ * @param {Redactor[]} redactors - The string processors containing the redaction logic.
+ *
+ * @returns {T} The cleaned string with any configured PII replaced by `[REDACTED PII_TYPE]`.
+ */
+export function _cleanStringPII(
+  value: string,
+  source: TransportItemType,
+  redactors: Redactor[],
+): string {
+  let kind: "string" | "url" = "string";
+  let decodedValue = value;
+
+  if (_containsEncodedComponents(value)) {
+    decodedValue = decodeURIComponent(value);
+    kind = "url";
+  }
+
+  return redactors.reduce(
+    (redactedValue: string, currentRedactor): string =>
+      currentRedactor(redactedValue, source, kind),
+    decodedValue,
+  );
+}

package/lib/internals/{pii-detection.ts → redaction/redactors/email.ts}

@@ -1,6 +1,6 @@
-import { faro, TransportItemType } from "@grafana/faro-web-sdk";
+import { faro } from "@grafana/faro-web-sdk";
 
-const EMAIL_REGEX = /[a-zA-Z0-9._%+-]+@([a-zA-Z0-9.-]+\.[a-z]{2,})/gi;
+const EMAIL_REGEX = /[\p{L}\p{N}._%+-]+@((?:[\p{L}\p{N}-]+\.)+[\p{L}]{2,})/giu;
 
 /**
  * Redacts all email addresses in the input string and collects metadata.
@@ -35,42 +35,14 @@ function _redactEmails(value: string): {
 }
 
 /**
- * Checks whether a string contains URI-encoded components.
+ * Redacts provided input and collects metadata metrics about redacted email domains,
+ * data source and kind.
  *
- * @param {string} value - The string to inspect.
- * @returns {boolean} `true` if the string is encoded, `false` otherwise.
- */
-function _containsEncodedComponents(value: string) {
-  try {
-    return decodeURI(value) !== decodeURIComponent(value);
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Cleans a string by redacting email addresses and emitting metrics for PII.
- *
- * If the string is URL-encoded, it will be decoded before redaction.
- * Metrics are emitted for each domain found in redacted email addresses.
- *
- * @param {string} value - The input string to sanitize.
- * @param {TransportItemType} source - The source context of the input.
- * @returns {string} The cleaned string with any email addresses replaced by `[REDACTED EMAIL]`.
+ * @param {string} value The input string potentially containing email addresses.
+ * @returns {string} the redacted value
  */
-export function _cleanStringPII(
-  value: string,
-  source: TransportItemType,
-): string {
-  let kind: "string" | "url" = "string";
-  let decodedValue = value;
-
-  if (_containsEncodedComponents(value)) {
-    decodedValue = decodeURIComponent(value);
-    kind = "url";
-  }
-
-  const { redacted, count, domains } = _redactEmails(decodedValue);
+export const emailRedactor = (value: string, source: string, kind: string) => {
+  const { redacted, count, domains } = _redactEmails(value);
 
   if (count > 0) {
     for (const [domain, domainCount] of Object.entries(domains)) {
@@ -93,4 +65,4 @@ export function _cleanStringPII(
     }
   }
   return redacted;
-}
+};

package/lib/internals/redaction/redactors/index.ts

@@ -0,0 +1,12 @@
+import { type FaroSDKConfig } from "../../../index.js";
+import { emailRedactor } from "./email.js";
+import { ipRedactor } from "./ip.js";
+
+export type Redactor = (value: string, source: string, kind: string) => string;
+
+export type RedactorKeys = keyof NonNullable<FaroSDKConfig["detection"]>;
+
+export const redactors: Record<RedactorKeys, Redactor> = {
+  email: emailRedactor,
+  ip: ipRedactor,
+};

package/lib/internals/redaction/redactors/ip.ts

@@ -0,0 +1,78 @@
+import { faro } from "@grafana/faro-web-sdk";
+
+// Generous IP address matchers (might match some invalid addresses like 192.168.01.1)
+const IPV4_REGEX =
+  /(?<!\d)(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}(?!\d)/gi;
+const IPV6_REGEX =
+  /(?<![0-9a-f:])((?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|:(?::[0-9A-Fa-f]{1,4}){1,7}|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?::[0-9A-Fa-f]{1,4}){1,6}|:(?::[0-9A-Fa-f]{1,4}){1,7}:?|(?:[0-9A-Fa-f]{1,4}:){1,4}:(?:25[0-5]|2[0-4]\d|1\d\d|\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|\d{1,2})){3})(?![0-9a-f:])/gi;
+
+/**
+ * Redacts all ip addresses in the input string and collects metadata.
+ *
+ * @param {string} value The input string potentially containing ip addresses.
+ * @returns {{
+ *   redacted: string,
+ *   count: number,
+ *   domains: Record<string, number>
+ * }}
+ *
+ * An object containing:
+ *   - `redacted`: the string with IP addresses replaced by `[REDACTED IPV*]`
+ *   - `counters`: total number of addresses redacted by IPv* type
+ *   - `domains`: a map of domain names to the number of times they were redacted
+ */
+function _redactIps(value: string): {
+  redacted: string;
+  counters: Record<string, number>;
+} {
+  const counters: Record<string, number> = {};
+  const redacted = value
+    .replace(IPV4_REGEX, () => {
+      counters["IPv4"] = (counters["IPv4"] || 0) + 1;
+      return "[REDACTED IPV4]";
+    })
+    .replace(IPV6_REGEX, () => {
+      counters["IPv4"] = (counters["IPv4"] || 0) + 1;
+      return "[REDACTED IPV6]";
+    });
+  return { redacted, counters };
+}
+
+/**
+ * Redacts provided input and collects metadata metrics about redacted IPs,
+ * data source and kind.
+ *
+ * @param {string} value The input string potentially containing IP addresses.
+ * @param {string} source The source of the attribute being redacted (log, span, metric).
+ * @param {string} kind The type of the data structure containing the PII
+ * @returns {string} the redacted value
+ */
+export const ipRedactor = (
+  value: string,
+  source: string,
+  kind: string,
+): string => {
+  const { redacted, counters } = _redactIps(value);
+
+  Object.entries(counters).forEach(([type, counter]) => {
+    if (counter > 0) {
+      faro.api.pushMeasurement(
+        {
+          type: "faro_o11y_pii_redaction",
+          values: {
+            redacted: counter,
+          },
+        },
+        {
+          context: {
+            pii_type: type,
+            redaction_source: source,
+            pii_format: kind,
+          },
+        },
+      );
+    }
+  });
+
+  return redacted;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ogcio/o11y-sdk-react",
-  "version": "0.3.0",
+  "version": "0.4.2",
   "description": "Opentelemetry standard instrumentation SDK for React based project",
   "main": "dist/index.js",
   "type": "module",
@@ -19,19 +19,19 @@
   "author": "team:ogcio/observability",
   "license": "ISC",
   "dependencies": {
-    "@grafana/faro-react": "^1.18.2",
-    "@grafana/faro-web-sdk": "^1.18.2",
-    "@grafana/faro-web-tracing": "^1.18.2",
+    "@grafana/faro-react": "^1.19.0",
+    "@grafana/faro-web-sdk": "^1.19.0",
+    "@grafana/faro-web-tracing": "^1.19.0",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "2.0.1",
-    "@opentelemetry/instrumentation-document-load": "^0.47.0",
-    "@opentelemetry/instrumentation-fetch": "^0.202.0",
-    "@opentelemetry/instrumentation-user-interaction": "^0.47.0"
+    "@opentelemetry/instrumentation-document-load": "^0.48.0",
+    "@opentelemetry/instrumentation-fetch": "^0.203.0",
+    "@opentelemetry/instrumentation-user-interaction": "^0.48.0"
   },
   "devDependencies": {
-    "@types/node": "^24.0.10",
+    "@types/node": "^24.3.0",
     "@vitest/coverage-v8": "^3.2.4",
-    "tsx": "^4.20.3",
+    "tsx": "^4.20.5",
     "typescript": "^5.8.3",
     "vitest": "^3.2.4"
   },

package/test/config.test.ts

@@ -2,7 +2,8 @@ import { describe, it, expect, vi, beforeEach } from "vitest";
 import buildFaroInstrumentation from "../lib/instrumentation.faro";
 import { initializeFaro } from "@grafana/faro-react";
 import { _beforeSend } from "../lib/internals/hooks";
-import { FaroSDKConfig } from "../lib";
+import { redactors } from "../lib/internals/redaction/redactors";
+import * as detectionTools from "../lib/internals/redaction/pii-detection";
 
 // Mock dependencies
 vi.mock("@grafana/faro-react", async () => {
@@ -89,31 +90,35 @@ describe("buildFaroInstrumentation", () => {
     expect(result).toBeUndefined();
   });
 
-  it("defaults detection.email to true if not provided", () => {
+  it("defaults all detection to true if not provided", () => {
     const config = {
       ...validConfig,
       detection: {},
     };
     buildFaroInstrumentation(config);
-    expect(initializeFaro).toHaveBeenCalled();
-    expect(config.detection.email).toBe(true);
+    expect(initializeFaro).toHaveBeenCalledOnce();
+    expect(initializeFaro.mock.calls[0][0].beforeSend.toString()).toEqual(
+      _beforeSend(Object.values(redactors)).toString(),
+    );
   });
 
   it("sets beforeSend if detection.email is true", () => {
     buildFaroInstrumentation({ ...validConfig, detection: { email: true } });
-    expect(initializeFaro).toHaveBeenCalledWith(
-      expect.objectContaining({
-        beforeSend: _beforeSend,
-      }),
+    expect(initializeFaro).toHaveBeenCalledOnce();
+    expect(initializeFaro.mock.calls[0][0].beforeSend.toString()).toEqual(
+      _beforeSend(Object.values(redactors)).toString(),
     );
   });
 
   it("does not set beforeSend if detection.email is false", () => {
     buildFaroInstrumentation({ ...validConfig, detection: { email: false } });
-    expect(initializeFaro).toHaveBeenCalledWith(
-      expect.not.objectContaining({
-        beforeSend: expect.any(Function),
-      }),
+    expect(initializeFaro).toHaveBeenCalledOnce();
+    expect(initializeFaro.mock.calls[0][0].beforeSend.toString()).toEqual(
+      _beforeSend(
+        Object.entries(redactors)
+          .filter(([key]) => key !== "email")
+          .map(([, redactor]) => redactor),
+      ).toString(),
     );
   });
 
@@ -165,20 +170,28 @@ describe("buildFaroInstrumentation", () => {
     expect(result).toEqual({ fakeFaro: true });
   });
 
-  it("sets default detection config if detection is not provided", () => {
+  it("skips detection if all redactors are set to false", () => {
     const config = {
       ...validConfig,
-      detection: undefined,
+      detection: Object.fromEntries(
+        Object.keys(redactors).map((key) => [key, false]),
+      ),
     };
 
     buildFaroInstrumentation(config);
 
-    expect(config.detection).toEqual({ email: true });
-    expect(initializeFaro).toHaveBeenCalledWith(
-      expect.objectContaining({
-        beforeSend: _beforeSend,
-      }),
-    );
+    const cleanStringMock = vi.spyOn(detectionTools, "_cleanStringPII");
+
+    expect(initializeFaro).toHaveBeenCalledOnce();
+    expect(initializeFaro.mock.calls[0][0].beforeSend).toBeTruthy();
+
+    initializeFaro.mock.calls[0][0].beforeSend({
+      type: "log",
+      payload: { name: "eventName", timestamp: "a timestamp" },
+      meta: {},
+    });
+
+    expect(cleanStringMock).not.toHaveBeenCalled();
   });
 
   it("handles comma-separated corsTraceHeaders", async () => {

package/test/lib/hooks.test.ts

@@ -21,6 +21,7 @@ vi.mock("@grafana/faro-web-sdk", async () => {
 });
 
 import { faro } from "@grafana/faro-web-sdk";
+import { redactors } from "../../lib/internals/redaction/redactors";
 
 describe("_beforeSend", () => {
   beforeEach(() => {
@@ -46,7 +47,7 @@ describe("_beforeSend", () => {
       },
     } satisfies TransportItem<LogEvent>;
 
-    const redacted: TransportItem<LogEvent> = _beforeSend(
+    const redacted: TransportItem<LogEvent> = _beforeSend([redactors.email])(
       item,
     ) as TransportItem<LogEvent>;
 
@@ -73,7 +74,7 @@ describe("_beforeSend", () => {
       },
     };
 
-    const redacted = _beforeSend(item)!;
+    const redacted = _beforeSend([redactors.email])(item)!;
 
     expect(redacted.payload.context.messages[1]).toBe(
       "email: [REDACTED EMAIL]",
@@ -98,7 +99,7 @@ describe("_beforeSend", () => {
       },
     };
 
-    const redacted = _beforeSend(item)!;
+    const redacted = _beforeSend([redactors.email])(item)!;
 
     expect(redacted.payload.context.events[0].message).toBe(
       "contact [REDACTED EMAIL]",
@@ -121,7 +122,7 @@ describe("_beforeSend", () => {
       meta: null,
     };
 
-    const redacted = _beforeSend(item)!;
+    const redacted = _beforeSend([redactors.email])(item)!;
 
     expect(redacted.payload.message).toBeNull();
     expect(redacted.payload.count).toBe(123);
@@ -141,7 +142,7 @@ describe("_beforeSend", () => {
       },
     };
 
-    const redacted = _beforeSend(item)!;
+    const redacted = _beforeSend([redactors.email])(item)!;
 
     expect(redacted.payload.message).toBe("contact [REDACTED EMAIL]");
     expect(faro.api.pushMeasurement).toHaveBeenCalledOnce();

package/test/lib/internals/redactors/email.test.ts

@@ -0,0 +1,81 @@
+import { describe, expect, it, vi, beforeEach, afterAll } from "vitest";
+
+import { emailRedactor } from "../../../../lib/internals/redaction/redactors/email";
+import { ipRedactor } from "../../../../lib/internals/redaction/redactors/ip";
+import { faro, TransportItemType } from "@grafana/faro-web-sdk";
+
+// Mock faro.api.pushMeasurement
+vi.mock("@grafana/faro-web-sdk", async () => {
+  const actual = await vi.importActual<any>("@grafana/faro-web-sdk");
+  return {
+    ...actual,
+    faro: {
+      api: {
+        pushMeasurement: vi.fn(),
+      },
+    },
+  };
+});
+
+describe("Email Redaction utils", () => {
+  afterAll(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe("tracks metrics", () => {
+    beforeEach(() => {
+      vi.clearAllMocks();
+    });
+
+    it("redacts plain PII and tracks redaction with metric", () => {
+      const input = "admin@example.com";
+      const output = emailRedactor(input, "log", "string");
+
+      expect(output).toBe("[REDACTED EMAIL]");
+      expect(faro.api.pushMeasurement).toHaveBeenCalledWith(
+        {
+          type: "faro_o11y_pii_redaction",
+          values: { redacted: 1 },
+        },
+        {
+          context: {
+            pii_type: "email",
+            redaction_source: TransportItemType.LOG,
+            pii_email_domain: "example.com",
+            pii_format: "string",
+          },
+        },
+      );
+    });
+
+    it("handles strings without PII unchanged", () => {
+      const input = "hello world";
+      const output = ipRedactor(input, "log", "string");
+
+      expect(output).toBe("hello world");
+      expect(faro.api.pushMeasurement).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("Redacts email addresses", () => {
+    it.each`
+      value                                  | expectedRedactedValue
+      ${"user+tag@example.com"}              | ${"[REDACTED EMAIL]"}
+      ${"user.name+tag+sorting@example.com"} | ${"[REDACTED EMAIL]"}
+      ${"x@example.museum"}                  | ${"[REDACTED EMAIL]"}
+      ${"a.b-c_d@example.co.uk"}             | ${"[REDACTED EMAIL]"}
+      ${"üser@example.de"}                   | ${"[REDACTED EMAIL]"}
+      ${"john.doe@xn--exmple-cua.com"}       | ${"[REDACTED EMAIL]"}
+      ${"üser@example.de"}                   | ${"[REDACTED EMAIL]"}
+      ${"plainaddress"}                      | ${"plainaddress"}
+      ${"@missinglocal.org"}                 | ${"@missinglocal.org"}
+      ${"user@invalid_domain.com"}           | ${"user@invalid_domain.com"}
+    `(
+      "returns $expectedRedactedValue for value '$value'",
+      async ({ value, expectedRedactedValue }: Record<string, string>) => {
+        const result = emailRedactor(value, "log", "string");
+        expect(result).toBe(expectedRedactedValue);
+      },
+    );
+  });
+});

package/test/lib/internals/redactors/ip.test.ts

@@ -0,0 +1,86 @@
+import { describe, expect, it, vi, afterAll } from "vitest";
+
+import { faro } from "@grafana/faro-web-sdk";
+import { ipRedactor } from "../../../../lib/internals/redaction/redactors/ip";
+
+// Mock faro.api.pushMeasurement
+vi.mock("@grafana/faro-web-sdk", async () => {
+  const actual = await vi.importActual<any>("@grafana/faro-web-sdk");
+  return {
+    ...actual,
+    faro: {
+      api: {
+        pushMeasurement: vi.fn(),
+      },
+    },
+  };
+});
+
+describe("IP Redaction utils", () => {
+  afterAll(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe("tracks metrics", () => {
+    it("redacts plain PII and tracks redaction with metric", () => {
+      const input = "255.255.255.255";
+      const output = ipRedactor(input, "log", "string");
+
+      expect(output).toBe("[REDACTED IPV4]");
+      expect(faro.api.pushMeasurement).toHaveBeenCalledWith(
+        {
+          type: "faro_o11y_pii_redaction",
+          values: {
+            redacted: 1,
+          },
+        },
+        {
+          context: {
+            pii_format: "string",
+            pii_type: "IPv4",
+            redaction_source: "log",
+          },
+        },
+      );
+    });
+
+    it("handles strings without PII unchanged", () => {
+      const input = "hello world";
+      const output = ipRedactor(input, "log", "string");
+
+      expect(output).toBe("hello world");
+      expect(faro.api.pushMeasurement).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("Redacts IPv4 and IPv6", () => {
+    it.each`
+      value                                           | expectedRedactedValue
+      ${"hello world"}                                | ${"hello world"}
+      ${"hello 127.0.0.1"}                            | ${"hello [REDACTED IPV4]"}
+      ${"127.0.0.1, hello!"}                          | ${"[REDACTED IPV4], hello!"}
+      ${"127.0.0.1,127.0.0.1"}                        | ${"[REDACTED IPV4],[REDACTED IPV4]"}
+      ${"127.0.0.1127.0.0.1"}                         | ${"127.0.0.1127.0.0.1"}
+      ${"256.1.1.1"}                                  | ${"256.1.1.1"}
+      ${"0.0.0.0!"}                                   | ${"[REDACTED IPV4]!"}
+      ${"text0.0.0.0"}                                | ${"text[REDACTED IPV4]"}
+      ${"0.0.text0.0"}                                | ${"0.0.text0.0"}
+      ${"2001:0db8::1"}                               | ${"[REDACTED IPV6]"}
+      ${"::1"}                                        | ${"[REDACTED IPV6]"}
+      ${"text::1"}                                    | ${"text[REDACTED IPV6]"}
+      ${"::1text"}                                    | ${"[REDACTED IPV6]text"}
+      ${"sentence ending with f::1"}                  | ${"sentence ending with [REDACTED IPV6]"}
+      ${"sentence ending with :::1"}                  | ${"sentence ending with :::1"}
+      ${"2001:0DB8:85A3:0000:0000:8A2E:0370:7334::1"} | ${"2001:0DB8:85A3:0000:0000:8A2E:0370:7334::1"}
+      ${"2001:0DB8:85A3:0000:text:8A2E:0370:7334"}    | ${"2001:0DB8:85A3:0000:text:8A2E:0370:7334"}
+      ${"2001:0db8::12001:0db8::1"}                   | ${"2001:0db8::12001:0db8::1"}
+      ${"2001:0db8::1,2001:0db8::1"}                  | ${"[REDACTED IPV6],[REDACTED IPV6]"}
+    `(
+      "returns $expectedRedactedValue for value '$value'",
+      async ({ value, expectedRedactedValue }: Record<string, string>) => {
+        const result = ipRedactor(value, "log", "string");
+        expect(result).toBe(expectedRedactedValue);
+      },
+    );
+  });
+});

package/test/lib/pii-detection.test.ts

@@ -1,6 +1,11 @@
 import { TransportItemType } from "@grafana/faro-web-sdk";
 import { beforeEach, describe, expect, it, vi } from "vitest";
-import { _cleanStringPII } from "../../lib/internals/pii-detection";
+import {
+  _cleanStringPII,
+  _containsEncodedComponents,
+} from "../../lib/internals/redaction/pii-detection";
+import { faro } from "@grafana/faro-web-sdk";
+import { redactors } from "../../lib/internals/redaction/redactors";
 
 // Mock faro.api.pushMeasurement
 vi.mock("@grafana/faro-web-sdk", async () => {
@@ -15,8 +20,6 @@ vi.mock("@grafana/faro-web-sdk", async () => {
   };
 });
 
-import { faro } from "@grafana/faro-web-sdk";
-
 describe("_cleanStringPII", () => {
   beforeEach(() => {
     vi.clearAllMocks();
@@ -24,7 +27,9 @@ describe("_cleanStringPII", () => {
 
   it("should redact email and call pushMeasurement", () => {
     const input = "Contact me at alice@example.com.";
-    const result = _cleanStringPII(input, TransportItemType.LOG);
+    const result = _cleanStringPII(input, TransportItemType.LOG, [
+      redactors.email,
+    ]);
 
     expect(result).toBe("Contact me at [REDACTED EMAIL].");
     expect(faro.api.pushMeasurement).toHaveBeenCalledOnce();
@@ -46,7 +51,9 @@ describe("_cleanStringPII", () => {
 
   it("should decode and redact URI-encoded emails", () => {
     const encoded = "mailto%3Ajohn.doe%40gmail.com";
-    const result = _cleanStringPII(encoded, TransportItemType.EXCEPTION);
+    const result = _cleanStringPII(encoded, TransportItemType.EXCEPTION, [
+      redactors.email,
+    ]);
 
     expect(result).toBe("mailto:[REDACTED EMAIL]");
     expect(faro.api.pushMeasurement).toHaveBeenCalledOnce();
@@ -54,7 +61,9 @@ describe("_cleanStringPII", () => {
 
   it("should return same string when no email present", () => {
     const input = "Just a normal message.";
-    const result = _cleanStringPII(input, TransportItemType.LOG);
+    const result = _cleanStringPII(input, TransportItemType.LOG, [
+      redactors.email,
+    ]);
 
     expect(result).toBe(input);
     expect(faro.api.pushMeasurement).not.toHaveBeenCalled();
@@ -62,9 +71,109 @@ describe("_cleanStringPII", () => {
 
   it("should return same string when decodeURIComponent fail", () => {
     const input = "mailto%john.doe%4gmail.com";
-    const result = _cleanStringPII(input, TransportItemType.LOG);
+    const result = _cleanStringPII(input, TransportItemType.LOG, [
+      redactors.email,
+    ]);
 
     expect(result).toBe(input);
     expect(faro.api.pushMeasurement).not.toHaveBeenCalled();
   });
 });
+
+describe("_containsEncodedComponents", () => {
+  describe("should return true for properly URL encoded strings", () => {
+    it.each([
+      ["hello%20world", "Space encoded as %20"],
+      ["test%2Bvalue", "Plus sign encoded as %2B"],
+      ["path%2Fto%2Ffile", "Forward slashes encoded"],
+      ["user%40domain.com", "@ symbol encoded"],
+      ["100%25%20off", "Percent and space encoded"],
+      ["a%3Db%26c%3Dd", "Query parameters (a=b&c=d)"],
+      ["caf%C3%A9", "UTF-8 encoded (café)"],
+      ["price%3A%20%2410", "Colon, space, dollar ($10)"],
+      ["%22quoted%22", "Double quotes encoded"],
+      ["https%3A%2F%2Fexample.com", "Full URL encoded"],
+      ["file%20name.txt", "filename encoded"],
+      ["search%3Fq%3Dhello%20world", "Query string encoded"],
+      ["%3C%3E%26%22%27", "HTML special chars encoded (<>&\"')"],
+      ["%E2%9C%93", "UTF-8 checkmark (✓) encoded"],
+      ["test%2b", "Lowercase hex"],
+      ["%E4%B8%AD%E6%96%87", "Chinese characters encoded"],
+    ])('should detect "%s" as URL encoded (%s)', (input, description) => {
+      expect(_containsEncodedComponents(input)).toBe(true);
+    });
+  });
+
+  describe("should return false for non-URL encoded strings", () => {
+    it.each([
+      ["test", "Simple ASCII string"],
+      ["hello world", "Unencoded space"],
+      ["user@domain.com", "Unencoded email"],
+      ["simple123", "Alphanumeric only"],
+      ["", "Empty string"],
+      ["25%%", "Literal percent signs"],
+      ["100% off", "Percent without hex digits"],
+      ["test%2", "Incomplete percent encoding"],
+      ["hello%ZZ", "Invalid hex digits"],
+      ["test%2G", "Invalid hex digit G"],
+      ["bad%encoding%here", "Percent without hex pairs"],
+      ["hello%20world and more", "Partially encoded string"],
+      ["hello%20world%21%20how%20are%20you", "Overly encoded string"],
+      ["café", "Unicode characters (unencoded)"],
+      ["hello+world", "Plus sign (form encoding style)"],
+      ["test%", "Trailing percent"],
+      ["hello%20world%", "Encoded content with trailing percent"],
+      ["%", "Single percent"],
+      ["%%", "Double percent"],
+      ["normal text with % symbols", "Text with percent but no encoding"],
+      ["price: $100%", "Currency with percent"],
+      ["file.txt", "Simple filename"],
+      ["path/to/file", "Unencoded path"],
+      ["query?param=value", "Unencoded query string"],
+      ["hello%world", "Percent without following hex"],
+      ["test%1", "Single hex digit after percent"],
+      ["hello%zz", "Non-hex characters after percent"],
+    ])('should not detect "%s" as URL encoded (%s)', (input, description) => {
+      expect(_containsEncodedComponents(input)).toBe(false);
+    });
+  });
+
+  describe("Error handling", () => {
+    it.each([
+      ["%C0%80", "Overlong UTF-8 encoding (security concern)"],
+      ["%ED%A0%80", "UTF-8 surrogate (invalid)"],
+      ["%FF%FE", "Invalid UTF-8 sequence"],
+      ["test%20%ZZ", "Mix of valid and invalid encoding"],
+    ])('should handle "%s" (%s)', (input, description) => {
+      // These should not throw errors
+      expect(() => _containsEncodedComponents(input)).not.toThrow();
+
+      // Most of these should return false due to invalid sequences
+      // or security-related encoding issues
+      const result = _containsEncodedComponents(input);
+      expect(typeof result).toBe("boolean");
+    });
+  });
+
+  describe("real-world url examples", () => {
+    it.each([
+      [
+        "https%3A%2F%2Fgoogle.com%2Fsearch%3Fq%3Djavascript",
+        "Encoded Google search URL",
+      ],
+      ["The%20quick%20brown%20fox", "Sentence with spaces encoded"],
+      [
+        "/api/user?body=here%20are%20all%20my%20secrets",
+        "contextually encoded API path",
+      ],
+      ["redirect_uri=https%3A%2F%2Fapp.com%2Fcallback", "OAuth redirect URI"],
+      ["data%3Atext%2Fplain%3Bbase64%2CSGVsbG8%3D", "Data URL encoded"],
+    ])('real-world case: "%s" (%s)', (input, description) => {
+      const result = _containsEncodedComponents(input);
+
+      // Verify the function doesn't crash
+      expect(typeof result).toBe("boolean");
+      expect(result).toBe(true);
+    });
+  });
+});

package/dist/lib/internals/pii-detection.d.ts

@@ -1,12 +0,0 @@
-import { TransportItemType } from "@grafana/faro-web-sdk";
-/**
- * Cleans a string by redacting email addresses and emitting metrics for PII.
- *
- * If the string is URL-encoded, it will be decoded before redaction.
- * Metrics are emitted for each domain found in redacted email addresses.
- *
- * @param {string} value - The input string to sanitize.
- * @param {TransportItemType} source - The source context of the input.
- * @returns {string} The cleaned string with any email addresses replaced by `[REDACTED EMAIL]`.
- */
-export declare function _cleanStringPII(value: string, source: TransportItemType): string;