@rasputin-ai/core 0.7.1 → 0.7.2-beta.1

package/README.md

@@ -1,3 +1,3 @@
-# Rasputin AI SDK — Core
-
-Low-level error capture, stack parsing, source maps, and ingest transport. Most applications should use [@rasputin-ai/node](https://www.npmjs.com/package/@rasputin-ai/node), [@rasputin-ai/elysia](https://www.npmjs.com/package/@rasputin-ai/elysia), or [@rasputin-ai/browser](https://www.npmjs.com/package/@rasputin-ai/browser) instead.
+# Rasputin AI SDK — Core
+
+Low-level error capture, stack parsing, source maps, and ingest transport. Most applications should use [@rasputin-ai/node](https://www.npmjs.com/package/@rasputin-ai/node), [@rasputin-ai/elysia](https://www.npmjs.com/package/@rasputin-ai/elysia), or [@rasputin-ai/browser](https://www.npmjs.com/package/@rasputin-ai/browser) instead.

package/dist/create-client/create-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-client.d.ts","sourceRoot":"","sources":["../../src/create-client/create-client.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAwBhG,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,YAGlC,CAAC;AAaF;;;GAGG;AACH,eAAO,MAAM,YAAY,GACxB,SAAS,eAAe,EACxB,QAAO,iBAAsB,KAC3B,cAkKF,CAAC"}
+{"version":3,"file":"create-client.d.ts","sourceRoot":"","sources":["../../src/create-client/create-client.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAwBhG,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,YAGlC,CAAC;AAaF;;;GAGG;AACH,eAAO,MAAM,YAAY,GACxB,SAAS,eAAe,EACxB,QAAO,iBAAsB,KAC3B,cAoKF,CAAC"}

package/dist/derivation/rasputin-redacted.d.ts

@@ -0,0 +1,3 @@
+/** Wire/runtime placeholder when a captured value was hidden. Keep in sync with `packages/~core/constants/rasputin-redacted.ts`. */
+export declare const RASPUTIN_REDACTED: "[RASPUTIN_REDACTED]";
+//# sourceMappingURL=rasputin-redacted.d.ts.map

package/dist/derivation/rasputin-redacted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rasputin-redacted.d.ts","sourceRoot":"","sources":["../../src/derivation/rasputin-redacted.ts"],"names":[],"mappings":"AAAA,oIAAoI;AACpI,eAAO,MAAM,iBAAiB,EAAG,qBAA8B,CAAC"}

package/dist/derivation/redact-env-secret-values.d.ts

@@ -0,0 +1,10 @@
+type EnvSecretMatcher = {
+    redact: (text: string) => string;
+    needleCount: number;
+};
+export declare const MAX_ENV_SECRET_NEEDLE_LENGTH = 512;
+export declare const collectEnvSecretValues: (env?: NodeJS.ProcessEnv) => string[];
+export declare const createExactSecretMatcher: (secrets: readonly string[]) => EnvSecretMatcher;
+export declare const createEnvSecretMatcher: (env?: NodeJS.ProcessEnv) => EnvSecretMatcher;
+export {};
+//# sourceMappingURL=redact-env-secret-values.d.ts.map

package/dist/derivation/redact-env-secret-values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-env-secret-values.d.ts","sourceRoot":"","sources":["../../src/derivation/redact-env-secret-values.ts"],"names":[],"mappings":"AAOA,KAAK,gBAAgB,GAAG;IACvB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;CACpB,CAAC;AAIF,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAsHhD,eAAO,MAAM,sBAAsB,GAAI,MAAK,MAAM,CAAC,UAAwB,KAAG,MAAM,EA4CnF,CAAC;AAEF,eAAO,MAAM,wBAAwB,GAAI,SAAS,SAAS,MAAM,EAAE,KAAG,gBAgCrE,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAI,MAAK,MAAM,CAAC,UAAwB,KAAG,gBAM7E,CAAC"}

package/dist/index.d.ts

@@ -10,7 +10,9 @@ export { createIngestEvent } from './create-ingest-event/create-ingest-event';
 export type { RequestContext } from './create-ingest-event/create-ingest-event-types';
 export type { RuntimeAwaitedEvent, RuntimeCaptureCoverage, RuntimeCaptureProfile, RuntimeExecutionEvent, RuntimeExecutionKind, RuntimeExecutionMetadata, RuntimeExecutionRecorderMetrics, RuntimeExecutionRequest, RuntimeExecutionState, RuntimeExpressionObservedEvent, RuntimeFunctionCallsSuppressedEvent, RuntimeFunctionEnterEvent, RuntimeFunctionExitEvent, RuntimeFunctionThrowEvent, RuntimeHistoryLink, RuntimeProvenance, RuntimeStateSizeTruncation, RuntimeThrowLocation, } from './create-ingest-event/runtime-execution-state-types';
 export { hashInstrumentationManifest } from './derivation/hash-instrumentation-manifest';
+export { RASPUTIN_REDACTED } from './derivation/rasputin-redacted';
 export { isRasputinTaggedValue, RASPUTIN_WIRE_TAG, type RasputinTaggedValue, rasputinOmitted, rasputinRedacted, rasputinTagKind, rasputinTruncated, rasputinUnavailable, rasputinUnknown, } from './derivation/rasputin-wire-tag';
+export { createEnvSecretMatcher, MAX_ENV_SECRET_NEEDLE_LENGTH, } from './derivation/redact-env-secret-values';
 export { defaultSensitivePropertyNames, propertyNameIsSensitive, } from './derivation/sensitive-property-name';
 export type { InstrumentationArgIdentifier, InstrumentationManifestCallSite, InstrumentationManifestContent, InstrumentationManifestDestructure, InstrumentationManifestFunction, InstrumentationParamBinding, InstrumentationSkipReason, SourceVerification, SourceVerificationIssue, } from './instrumentation-manifest/instrumentation-manifest-types';
 export { INSTRUMENTATION_MANIFEST_SCHEMA_VERSION } from './instrumentation-manifest/instrumentation-manifest-types';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,YAAY,EACX,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,eAAe,GACf,MAAM,qCAAqC,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AACnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,YAAY,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACtF,YAAY,EACX,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,+BAA+B,EAC/B,uBAAuB,EACvB,qBAAqB,EACrB,8BAA8B,EAC9B,mCAAmC,EACnC,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,iBAAiB,EACjB,0BAA0B,EAC1B,oBAAoB,GACpB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,GACf,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,6BAA6B,EAC7B,uBAAuB,GACvB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EACX,4BAA4B,EAC5B,+BAA+B,EAC/B,8BAA8B,EAC9B,kCAAkC,EAClC,+BAA+B,EAC/B,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,GACvB,MAAM,2DAA2D,CAAC;AACnE,OAAO,EAAE,uCAAuC,EAAE,MAAM,2DAA2D,CAAC;AACpH,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,YAAY,EAAE,KAAK,EAAE,MAAM,qCAAqC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EACN,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,YAAY,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,YAAY,EACX,aAAa,EACb,uBAAuB,GACvB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EACX,yBAAyB,EACzB,aAAa,EACb,cAAc,GACd,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,GAChB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,YAAY,EACX,wBAAwB,EACxB,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,sBAAsB,EACtB,uBAAuB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,YAAY,EACX,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,cAAc,GACd,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,YAAY,EACX,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,eAAe,GACf,MAAM,qCAAqC,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AACnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,YAAY,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACtF,YAAY,EACX,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,+BAA+B,EAC/B,uBAAuB,EACvB,qBAAqB,EACrB,8BAA8B,EAC9B,mCAAmC,EACnC,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,iBAAiB,EACjB,0BAA0B,EAC1B,oBAAoB,GACpB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,GACf,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,sBAAsB,EACtB,4BAA4B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACN,6BAA6B,EAC7B,uBAAuB,GACvB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EACX,4BAA4B,EAC5B,+BAA+B,EAC/B,8BAA8B,EAC9B,kCAAkC,EAClC,+BAA+B,EAC/B,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,GACvB,MAAM,2DAA2D,CAAC;AACnE,OAAO,EAAE,uCAAuC,EAAE,MAAM,2DAA2D,CAAC;AACpH,OAAO,EAAE,6BAA6B,EAAE,MAAM,4DAA4D,CAAC;AAC3G,YAAY,EAAE,KAAK,EAAE,MAAM,qCAAqC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EACN,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,YAAY,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,YAAY,EACX,aAAa,EACb,uBAAuB,GACvB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EACX,yBAAyB,EACzB,aAAa,EACb,cAAc,GACd,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,GAChB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,YAAY,EACX,wBAAwB,EACxB,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,sBAAsB,EACtB,uBAAuB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,YAAY,EACX,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,cAAc,GACd,MAAM,6BAA6B,CAAC"}

package/dist/index.js

@@ -361,6 +361,356 @@ var finalizeResolution = (resolution, stackFrames) => {
   return "exact";
 };
 
+// src/derivation/rasputin-redacted.ts
+var RASPUTIN_REDACTED = "[RASPUTIN_REDACTED]";
+
+// src/derivation/sensitive-property-name.ts
+var DEFAULT_SENSITIVE_PROPERTY_NAMES = [
+  "password",
+  "passwd",
+  "pwd",
+  "passphrase",
+  "token",
+  "accesstoken",
+  "refreshtoken",
+  "sessiontoken",
+  "authorization",
+  "auth",
+  "bearer",
+  "cookie",
+  "cookies",
+  "signedcookies",
+  "setcookie",
+  "secret",
+  "secrets",
+  "clientsecret",
+  "apikey",
+  "xapikey",
+  "credential",
+  "credentials",
+  "privatekey",
+  "privkey",
+  "pem",
+  "jwt",
+  "otp",
+  "totp",
+  "pin",
+  "mfacode",
+  "sessionid",
+  "sid",
+  "databaseurl",
+  "connectionstring",
+  "dsn",
+  "mongouri",
+  "redisurl",
+  "signingkey",
+  "encryptionkey",
+  "cvv",
+  "cvc",
+  "cardnumber",
+  "ssn",
+  "creditcard",
+  "securitycode",
+  "twofactorcode",
+  "masterkey",
+  "servicerolekey",
+  "stripekey",
+  "rawheaders"
+];
+var DEFAULT_SENSITIVE_PROPERTY_NAME_SET = new Set(DEFAULT_SENSITIVE_PROPERTY_NAMES);
+var SENSITIVE_SEGMENTS = /* @__PURE__ */ new Set([
+  "password",
+  "passwd",
+  "pwd",
+  "passphrase",
+  "token",
+  "secret",
+  "cookie",
+  "cookies",
+  "authorization",
+  "auth",
+  "bearer",
+  "credential",
+  "credentials",
+  "jwt",
+  "otp",
+  "totp",
+  "pin",
+  "sid",
+  "dsn",
+  "pem",
+  "privkey",
+  "cvv",
+  "cvc",
+  "ssn",
+  "secrets"
+]);
+var SENSITIVE_SUFFIXES = [
+  "password",
+  "passwd",
+  "token",
+  "secret",
+  "apikey",
+  "privatekey",
+  "credential",
+  "credentials",
+  "cookie"
+];
+var compactKey = (key) => {
+  let compacted = "";
+  for (let index = 0; index < key.length; index++) {
+    const code = key.charCodeAt(index);
+    if (code === 45 || code === 46 || code === 95) continue;
+    compacted += code >= 65 && code <= 90 ? String.fromCharCode(code + 32) : key[index];
+  }
+  return compacted;
+};
+var stripTrailingDigits = (value) => {
+  let end = value.length;
+  while (end > 0) {
+    const code = value.charCodeAt(end - 1);
+    if (code < 48 || code > 57) break;
+    end--;
+  }
+  return end === 0 ? value : value.slice(0, end);
+};
+var segmentsOf = (key) => {
+  const segments = [];
+  let current = "";
+  for (let index = 0; index < key.length; index++) {
+    const char = key[index] ?? "";
+    const code = key.charCodeAt(index);
+    if (code === 45 || code === 46 || code === 95) {
+      if (current) segments.push(current.toLowerCase());
+      current = "";
+      continue;
+    }
+    if (current && code >= 65 && code <= 90) {
+      const prev = current.charCodeAt(current.length - 1);
+      const prevIsLower = prev >= 97 && prev <= 122;
+      const next = key.charCodeAt(index + 1);
+      const nextIsLower = next >= 97 && next <= 122;
+      if (prevIsLower || nextIsLower) {
+        segments.push(current.toLowerCase());
+        current = char;
+        continue;
+      }
+    }
+    current += char;
+  }
+  if (current) segments.push(current.toLowerCase());
+  return segments;
+};
+var adjacentPairsSensitive = (left, right) => left === "api" && right === "key" || left === "private" && right === "key" || left === "client" && right === "secret" || left === "set" && right === "cookie" || left === "database" && right === "url" || left === "connection" && right === "string" || left === "mongo" && (right === "uri" || right === "url") || left === "mongodb" && (right === "uri" || right === "url") || left === "redis" && (right === "uri" || right === "url") || left === "postgres" && (right === "uri" || right === "url") || left === "database" && right === "uri" || left === "signing" && right === "key" || left === "master" && right === "key" || left === "stripe" && right === "key" || left === "service" && right === "role" || left === "security" && right === "code" || left === "two" && right === "factor" || left === "encryption" && right === "key" || left === "session" && (right === "id" || right === "key" || right === "token") || left === "card" && right === "number" || left === "mfa" && right === "code";
+var defaultSensitivePropertyNames = () => DEFAULT_SENSITIVE_PROPERTY_NAME_SET;
+var propertyNameIsSensitive = (key) => {
+  const compacted = compactKey(key);
+  const compactForms = [compacted, stripTrailingDigits(compacted)].filter(
+    (value, index, values) => value.length > 0 && values.indexOf(value) === index
+  );
+  for (const form of compactForms) {
+    if (DEFAULT_SENSITIVE_PROPERTY_NAME_SET.has(form)) return true;
+    for (const suffix of SENSITIVE_SUFFIXES) {
+      if (form.endsWith(suffix)) return true;
+    }
+    if (form.includes("apikey") || form.includes("xapikey")) return true;
+  }
+  const segments = segmentsOf(key).map((segment) => stripTrailingDigits(segment) || segment);
+  for (const segment of segments) {
+    if (SENSITIVE_SEGMENTS.has(segment)) return true;
+  }
+  for (let index = 0; index < segments.length - 1; index++) {
+    const left = segments[index];
+    const right = segments[index + 1];
+    if (left && right && adjacentPairsSensitive(left, right)) return true;
+  }
+  return false;
+};
+
+// src/derivation/redact-env-secret-values.ts
+var MIN_ENV_SECRET_LENGTH = 6;
+var MAX_ENV_SECRET_NEEDLE_LENGTH = 512;
+var COMMON_CONFIG_VALUES = /* @__PURE__ */ new Set([
+  "enabled",
+  "disabled",
+  "production",
+  "development",
+  "staging",
+  "testing",
+  "localhost",
+  "undefined"
+]);
+var identityMatcher = {
+  redact: (text) => text,
+  needleCount: 0
+};
+var envKeyLooksSensitive = (key) => propertyNameIsSensitive(key) || key.replace(/[-._]/g, "").toLowerCase().includes("accesskey");
+var isCollectableSecretValue = (value) => value.length >= MIN_ENV_SECRET_LENGTH && !COMMON_CONFIG_VALUES.has(value.toLowerCase());
+var looksLikeUrl = (value) => {
+  const schemeEnd = value.indexOf("://");
+  return schemeEnd > 0 && schemeEnd < 32;
+};
+var urlUserinfo = (value) => {
+  const schemeEnd = value.indexOf("://");
+  if (schemeEnd <= 0) return void 0;
+  const rest = value.slice(schemeEnd + 3);
+  let authorityEnd = rest.length;
+  for (const marker of ["/", "?", "#"]) {
+    const at = rest.indexOf(marker);
+    if (at >= 0 && at < authorityEnd) authorityEnd = at;
+  }
+  const authority = rest.slice(0, authorityEnd);
+  const userinfoEnd = authority.lastIndexOf("@");
+  if (userinfoEnd < 0) return void 0;
+  const userinfo = authority.slice(0, userinfoEnd);
+  if (!userinfo) return void 0;
+  const colon = userinfo.indexOf(":");
+  const encodedPassword = colon < 0 ? "" : userinfo.slice(colon + 1);
+  if (!encodedPassword) return void 0;
+  let password = encodedPassword;
+  try {
+    password = decodeURIComponent(encodedPassword.replace(/\+/g, " "));
+  } catch {
+    password = encodedPassword;
+  }
+  return { password, encodedPassword, userinfo };
+};
+var querySecretValues = (value) => {
+  const queryAt = value.indexOf("?");
+  if (queryAt < 0) return [];
+  const hashAt = value.indexOf("#", queryAt + 1);
+  const query = hashAt < 0 ? value.slice(queryAt + 1) : value.slice(queryAt + 1, hashAt);
+  if (!query.includes("=")) return [];
+  const found = [];
+  const parts = query.split("&");
+  for (let index = 0; index < parts.length; index++) {
+    const part = parts[index];
+    if (!part) continue;
+    const equals = part.indexOf("=");
+    if (equals <= 0) continue;
+    const rawKey = part.slice(0, equals);
+    let key = rawKey;
+    try {
+      key = decodeURIComponent(rawKey.replace(/\+/g, " "));
+    } catch {
+      key = rawKey;
+    }
+    if (!propertyNameIsSensitive(key) && !propertyNameIsSensitive(rawKey)) continue;
+    const rawValue = part.slice(equals + 1);
+    if (!rawValue) continue;
+    found.push(rawValue);
+    try {
+      const decoded = decodeURIComponent(rawValue.replace(/\+/g, " "));
+      if (decoded !== rawValue) found.push(decoded);
+    } catch {
+    }
+  }
+  return found;
+};
+var addNeedle = (needles, value) => {
+  if (value.length < MIN_ENV_SECRET_LENGTH) return;
+  needles.add(
+    value.length > MAX_ENV_SECRET_NEEDLE_LENGTH ? value.slice(0, MAX_ENV_SECRET_NEEDLE_LENGTH) : value
+  );
+};
+var addWithRepresentations = (needles, value) => {
+  addNeedle(needles, value);
+  if (value.length > MAX_ENV_SECRET_NEEDLE_LENGTH) return;
+  try {
+    const encoded = encodeURIComponent(value);
+    if (encoded !== value) addNeedle(needles, encoded);
+    const plus = encoded.replace(/%20/g, "+");
+    if (plus !== encoded) addNeedle(needles, plus);
+  } catch {
+  }
+  try {
+    const jsonEscaped = JSON.stringify(value).slice(1, -1);
+    if (jsonEscaped !== value) addNeedle(needles, jsonEscaped);
+  } catch {
+  }
+};
+var collectEnvSecretValues = (env = process.env) => {
+  const needles = /* @__PURE__ */ new Set();
+  let keys;
+  try {
+    keys = Object.keys(env);
+  } catch {
+    return [];
+  }
+  for (let index = 0; index < keys.length; index++) {
+    const key = keys[index];
+    if (!key || key === "PWD") continue;
+    let value;
+    try {
+      value = env[key];
+    } catch {
+      continue;
+    }
+    if (typeof value !== "string" || value.length === 0) continue;
+    try {
+      const userinfo = urlUserinfo(value);
+      if (userinfo) {
+        addWithRepresentations(needles, userinfo.password);
+        if (userinfo.encodedPassword !== userinfo.password) {
+          addWithRepresentations(needles, userinfo.encodedPassword);
+        }
+        if (userinfo.userinfo.length >= MIN_ENV_SECRET_LENGTH) {
+          addWithRepresentations(needles, userinfo.userinfo);
+        }
+      }
+      const queryValues = querySecretValues(value);
+      for (let queryIndex = 0; queryIndex < queryValues.length; queryIndex++) {
+        const part = queryValues[queryIndex];
+        if (part) addWithRepresentations(needles, part);
+      }
+      if (!envKeyLooksSensitive(key) || !isCollectableSecretValue(value)) continue;
+      if (looksLikeUrl(value) && !userinfo && queryValues.length === 0) continue;
+      addWithRepresentations(needles, value);
+    } catch {
+    }
+  }
+  return [...needles];
+};
+var createExactSecretMatcher = (secrets) => {
+  const unique = [];
+  const exact = /* @__PURE__ */ new Set();
+  for (let index = 0; index < secrets.length; index++) {
+    const secret = secrets[index];
+    if (!secret || secret.length < MIN_ENV_SECRET_LENGTH || exact.has(secret)) continue;
+    exact.add(secret);
+    unique.push(secret);
+  }
+  if (unique.length === 0) return identityMatcher;
+  unique.sort((left, right) => right.length - left.length);
+  const minLen = unique[unique.length - 1]?.length ?? MIN_ENV_SECRET_LENGTH;
+  return {
+    needleCount: unique.length,
+    redact(text) {
+      try {
+        if (text.length < minLen) return text;
+        if (exact.has(text)) return RASPUTIN_REDACTED;
+        let result = text;
+        for (let index = 0; index < unique.length; index++) {
+          const needle = unique[index];
+          if (!needle || result.length < needle.length) continue;
+          if (result.indexOf(needle) === -1) continue;
+          result = result.replaceAll(needle, RASPUTIN_REDACTED);
+        }
+        return result;
+      } catch {
+        return text;
+      }
+    }
+  };
+};
+var createEnvSecretMatcher = (env = process.env) => {
+  try {
+    return createExactSecretMatcher(collectEnvSecretValues(env));
+  } catch {
+    return identityMatcher;
+  }
+};
+
 // src/normalize-frames/normalize-frames.ts
 import { isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
@@ -808,7 +1158,7 @@ var resolveSourceMaps = async (frames) => {
 
 // src/sdk-meta.ts
 var SDK_NAME = "@rasputin-ai/core";
-var SDK_VERSION = "0.7.1";
+var SDK_VERSION = "0.7.2-beta.1";
 
 // src/suppression/identity-needs-message-template.ts
 var identityNeedsMessageTemplate = (type, code) => {
@@ -1937,6 +2287,7 @@ var createClient = (options, hooks = {}) => {
     const activation = resolveClientActivation(options);
     if (!activation.enabled) return noopClient();
     const { ingestToken, projectApiKey, apiUrl, release } = activation;
+    const redactEnvSecrets = createEnvSecretMatcher().redact;
     const environment = options.environment;
     const { ingestUrl, deployUrl } = resolveEndpointUrls(apiUrl);
     const repoRoot = resolveRepoRoot(options);
@@ -2008,6 +2359,7 @@ var createClient = (options, hooks = {}) => {
           resolution: "none",
           request: context?.request
         });
+        event.message = redactEnvSecrets(event.message);
         const decision = suppression.decide({
           errorType: event.type,
           message: event.message,
@@ -2139,169 +2491,6 @@ var isRasputinTaggedValue = (value) => {
 };
 var rasputinTagKind = (value) => isRasputinTaggedValue(value) ? value[1] : void 0;
 
-// src/derivation/sensitive-property-name.ts
-var DEFAULT_SENSITIVE_PROPERTY_NAMES = [
-  "password",
-  "passwd",
-  "pwd",
-  "passphrase",
-  "token",
-  "accesstoken",
-  "refreshtoken",
-  "sessiontoken",
-  "authorization",
-  "auth",
-  "bearer",
-  "cookie",
-  "cookies",
-  "signedcookies",
-  "setcookie",
-  "secret",
-  "secrets",
-  "clientsecret",
-  "apikey",
-  "xapikey",
-  "credential",
-  "credentials",
-  "privatekey",
-  "privkey",
-  "pem",
-  "jwt",
-  "otp",
-  "totp",
-  "pin",
-  "mfacode",
-  "sessionid",
-  "sid",
-  "databaseurl",
-  "connectionstring",
-  "dsn",
-  "mongouri",
-  "redisurl",
-  "signingkey",
-  "encryptionkey",
-  "cvv",
-  "cvc",
-  "cardnumber",
-  "ssn",
-  "creditcard",
-  "securitycode",
-  "twofactorcode",
-  "masterkey",
-  "servicerolekey",
-  "stripekey",
-  "rawheaders"
-];
-var DEFAULT_SENSITIVE_PROPERTY_NAME_SET = new Set(DEFAULT_SENSITIVE_PROPERTY_NAMES);
-var SENSITIVE_SEGMENTS = /* @__PURE__ */ new Set([
-  "password",
-  "passwd",
-  "pwd",
-  "passphrase",
-  "token",
-  "secret",
-  "cookie",
-  "cookies",
-  "authorization",
-  "auth",
-  "bearer",
-  "credential",
-  "credentials",
-  "jwt",
-  "otp",
-  "totp",
-  "pin",
-  "sid",
-  "dsn",
-  "pem",
-  "privkey",
-  "cvv",
-  "cvc",
-  "ssn",
-  "secrets"
-]);
-var SENSITIVE_SUFFIXES = [
-  "password",
-  "passwd",
-  "token",
-  "secret",
-  "apikey",
-  "privatekey",
-  "credential",
-  "credentials",
-  "cookie"
-];
-var compactKey = (key) => {
-  let compacted = "";
-  for (let index = 0; index < key.length; index++) {
-    const code = key.charCodeAt(index);
-    if (code === 45 || code === 46 || code === 95) continue;
-    compacted += code >= 65 && code <= 90 ? String.fromCharCode(code + 32) : key[index];
-  }
-  return compacted;
-};
-var stripTrailingDigits = (value) => {
-  let end = value.length;
-  while (end > 0) {
-    const code = value.charCodeAt(end - 1);
-    if (code < 48 || code > 57) break;
-    end--;
-  }
-  return end === 0 ? value : value.slice(0, end);
-};
-var segmentsOf = (key) => {
-  const segments = [];
-  let current = "";
-  for (let index = 0; index < key.length; index++) {
-    const char = key[index] ?? "";
-    const code = key.charCodeAt(index);
-    if (code === 45 || code === 46 || code === 95) {
-      if (current) segments.push(current.toLowerCase());
-      current = "";
-      continue;
-    }
-    if (current && code >= 65 && code <= 90) {
-      const prev = current.charCodeAt(current.length - 1);
-      const prevIsLower = prev >= 97 && prev <= 122;
-      const next = key.charCodeAt(index + 1);
-      const nextIsLower = next >= 97 && next <= 122;
-      if (prevIsLower || nextIsLower) {
-        segments.push(current.toLowerCase());
-        current = char;
-        continue;
-      }
-    }
-    current += char;
-  }
-  if (current) segments.push(current.toLowerCase());
-  return segments;
-};
-var adjacentPairsSensitive = (left, right) => left === "api" && right === "key" || left === "private" && right === "key" || left === "client" && right === "secret" || left === "set" && right === "cookie" || left === "database" && right === "url" || left === "connection" && right === "string" || left === "mongo" && (right === "uri" || right === "url") || left === "mongodb" && (right === "uri" || right === "url") || left === "redis" && (right === "uri" || right === "url") || left === "postgres" && (right === "uri" || right === "url") || left === "database" && right === "uri" || left === "signing" && right === "key" || left === "master" && right === "key" || left === "stripe" && right === "key" || left === "service" && right === "role" || left === "security" && right === "code" || left === "two" && right === "factor" || left === "encryption" && right === "key" || left === "session" && (right === "id" || right === "key" || right === "token") || left === "card" && right === "number" || left === "mfa" && right === "code";
-var defaultSensitivePropertyNames = () => DEFAULT_SENSITIVE_PROPERTY_NAME_SET;
-var propertyNameIsSensitive = (key) => {
-  const compacted = compactKey(key);
-  const compactForms = [compacted, stripTrailingDigits(compacted)].filter(
-    (value, index, values) => value.length > 0 && values.indexOf(value) === index
-  );
-  for (const form of compactForms) {
-    if (DEFAULT_SENSITIVE_PROPERTY_NAME_SET.has(form)) return true;
-    for (const suffix of SENSITIVE_SUFFIXES) {
-      if (form.endsWith(suffix)) return true;
-    }
-    if (form.includes("apikey") || form.includes("xapikey")) return true;
-  }
-  const segments = segmentsOf(key).map((segment) => stripTrailingDigits(segment) || segment);
-  for (const segment of segments) {
-    if (SENSITIVE_SEGMENTS.has(segment)) return true;
-  }
-  for (let index = 0; index < segments.length - 1; index++) {
-    const left = segments[index];
-    const right = segments[index + 1];
-    if (left && right && adjacentPairsSensitive(left, right)) return true;
-  }
-  return false;
-};
-
 // src/instrumentation-manifest/instrumentation-manifest-types.ts
 var INSTRUMENTATION_MANIFEST_SCHEMA_VERSION = 3;
 
@@ -2333,9 +2522,12 @@ var uploadInstrumentationManifest = async (options) => {
 };
 export {
   INSTRUMENTATION_MANIFEST_SCHEMA_VERSION,
+  MAX_ENV_SECRET_NEEDLE_LENGTH,
+  RASPUTIN_REDACTED,
   RASPUTIN_WIRE_TAG,
   announceDeploy,
   createClient,
+  createEnvSecretMatcher,
   createIngestEvent,
   createSuppression,
   createTransport,

package/dist/sdk-meta.d.ts

@@ -1,4 +1,4 @@
 /** Generated by scripts/generate-sdk-meta.ts — do not edit. */
 export declare const SDK_NAME = "@rasputin-ai/core";
-export declare const SDK_VERSION = "0.7.1";
+export declare const SDK_VERSION = "0.7.2-beta.1";
 //# sourceMappingURL=sdk-meta.d.ts.map

package/dist/sdk-meta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdk-meta.d.ts","sourceRoot":"","sources":["../src/sdk-meta.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,eAAO,MAAM,QAAQ,sBAAsB,CAAC;AAC5C,eAAO,MAAM,WAAW,UAAU,CAAC"}
+{"version":3,"file":"sdk-meta.d.ts","sourceRoot":"","sources":["../src/sdk-meta.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,eAAO,MAAM,QAAQ,sBAAsB,CAAC;AAC5C,eAAO,MAAM,WAAW,iBAAiB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rasputin-ai/core",
-	"version": "0.7.1",
+	"version": "0.7.2-beta.1",
 	"description": "Core error capture, stack parsing, and ingest transport for Rasputin AI.",
 	"type": "module",
 	"exports": {