@rasputin-ai/core 0.7.1 → 0.8.0

package/dist/index.js

@@ -1,6 +1,9 @@
 // src/transport/node-http-fetch.ts
-import * as http from "node:http";
-import * as https from "node:https";
+import * as net from "node:net";
+import * as tls from "node:tls";
+var CONNECT_TIMEOUT_MS = 2e3;
+var abortError = () => Object.assign(new Error("aborted"), { name: "AbortError" });
+var connectTimeoutError = () => Object.assign(new Error("connect timeout"), { name: "ConnectTimeoutError" });
 var headerRecord = (headers) => {
   const view = new Headers(headers);
   const record = {};
@@ -9,26 +12,84 @@ var headerRecord = (headers) => {
   });
   return record;
 };
-var writeBody = (req, body) => {
-  if (body == null) {
-    req.end();
-    return;
-  }
-  if (typeof body === "string") {
-    req.end(body);
-    return;
-  }
+var toBuffer = (body) => {
+  if (body == null) return Buffer.alloc(0);
+  if (typeof body === "string") return Buffer.from(body);
   if (ArrayBuffer.isView(body)) {
-    req.end(Buffer.from(body.buffer, body.byteOffset, body.byteLength));
-    return;
-  }
-  if (body instanceof ArrayBuffer) {
-    req.end(Buffer.from(body));
-    return;
+    return Buffer.from(body.buffer, body.byteOffset, body.byteLength);
+  }
+  if (body instanceof ArrayBuffer) return Buffer.from(body);
+  return Buffer.alloc(0);
+};
+var encodeHttpRequest = (url, init) => {
+  const method = (init?.method ?? "GET").toUpperCase();
+  const path = `${url.pathname}${url.search}` || "/";
+  const headers = headerRecord(init?.headers);
+  const body = toBuffer(init?.body ?? null);
+  if (body.length > 0 && headers["content-length"] === void 0) {
+    headers["content-length"] = String(body.length);
+  }
+  if (headers.host === void 0) headers.host = url.host;
+  if (headers.connection === void 0) headers.connection = "close";
+  const head = [`${method} ${path} HTTP/1.1`];
+  for (const [key, value] of Object.entries(headers)) {
+    head.push(`${key}: ${value}`);
+  }
+  return Buffer.concat([Buffer.from(`${head.join("\r\n")}\r
+\r
+`), body]);
+};
+var tryDecodeChunked = (raw) => {
+  const parts = [];
+  let offset = 0;
+  for (; ; ) {
+    const lineEnd = raw.indexOf("\r\n", offset);
+    if (lineEnd < 0) return null;
+    const size = Number.parseInt(raw.subarray(offset, lineEnd).toString("ascii"), 16);
+    if (!Number.isFinite(size) || size < 0) throw new Error("invalid chunk size");
+    const dataStart = lineEnd + 2;
+    if (size === 0) return raw.length < dataStart + 2 ? null : Buffer.concat(parts);
+    const dataEnd = dataStart + size;
+    if (raw.length < dataEnd + 2) return null;
+    parts.push(raw.subarray(dataStart, dataEnd));
+    offset = dataEnd + 2;
+  }
+};
+var toResponseBody = (buf) => {
+  const copy = new Uint8Array(buf.byteLength);
+  copy.set(buf);
+  return copy;
+};
+var tryParseHttpResponse = (raw, connectionClosed) => {
+  const split = raw.indexOf("\r\n\r\n");
+  if (split < 0) return null;
+  const lines = raw.subarray(0, split).toString("latin1").split("\r\n");
+  const status = /^HTTP\/\d\.\d (\d{3})/.exec(lines[0] ?? "");
+  if (!status) throw new Error("invalid HTTP response");
+  const headers = new Headers();
+  for (const line of lines.slice(1)) {
+    const colon = line.indexOf(":");
+    if (colon < 0) continue;
+    headers.append(line.slice(0, colon).trim(), line.slice(colon + 1).trim());
+  }
+  const body = raw.subarray(split + 4);
+  if (headers.get("transfer-encoding")?.toLowerCase().includes("chunked")) {
+    const decoded = tryDecodeChunked(body);
+    return decoded === null ? null : new Response(toResponseBody(decoded), { status: Number(status[1]), headers });
+  }
+  const lengthHeader = headers.get("content-length");
+  if (lengthHeader !== null) {
+    const length = Number(lengthHeader);
+    if (!Number.isInteger(length) || length < 0) throw new Error("invalid content-length");
+    if (body.length < length) return null;
+    return new Response(toResponseBody(body.subarray(0, length)), {
+      status: Number(status[1]),
+      headers
+    });
   }
-  req.end();
+  return connectionClosed ? new Response(toResponseBody(body), { status: Number(status[1]), headers }) : null;
 };
-var createNodeHttpFetch = (unrefSockets = false) => (input, init) => new Promise((resolve4, reject) => {
+var defaultIngestFetch = () => (input, init) => new Promise((resolve4, reject) => {
   let parsed;
   try {
     parsed = new URL(String(input));
@@ -36,62 +97,77 @@ var createNodeHttpFetch = (unrefSockets = false) => (input, init) => new Promise
     reject(error);
     return;
   }
-  const lib = parsed.protocol === "https:" ? https : http;
-  const req = lib.request(
-    {
-      protocol: parsed.protocol,
-      hostname: parsed.hostname,
-      port: parsed.port,
-      path: `${parsed.pathname}${parsed.search}`,
-      method: init?.method ?? "GET",
-      headers: headerRecord(init?.headers),
-      agent: false
-    },
-    (response) => {
-      const chunks = [];
-      response.on("data", (chunk) => {
-        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-      });
-      response.on("end", () => {
-        const headers = new Headers();
-        for (const [key, value] of Object.entries(response.headers)) {
-          if (value === void 0) continue;
-          if (Array.isArray(value)) {
-            for (const item of value) headers.append(key, item);
-          } else {
-            headers.set(key, value);
-          }
-        }
-        resolve4(
-          new Response(Buffer.concat(chunks), {
-            status: response.statusCode ?? 0,
-            headers
-          })
-        );
-      });
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    reject(new Error(`unsupported protocol: ${parsed.protocol}`));
+    return;
+  }
+  if (init?.signal?.aborted) {
+    reject(abortError());
+    return;
+  }
+  const port = Number(parsed.port) || (parsed.protocol === "https:" ? 443 : 80);
+  const socket = parsed.protocol === "https:" ? tls.connect({ host: parsed.hostname, port, servername: parsed.hostname }) : net.connect({ host: parsed.hostname, port });
+  socket.unref();
+  let settled = false;
+  let sent = false;
+  let connectTimer;
+  const finish = (error, response) => {
+    if (settled) return;
+    settled = true;
+    if (connectTimer) {
+      clearTimeout(connectTimer);
+      connectTimer = void 0;
     }
-  );
-  const abort = () => {
-    req.destroy();
-    reject(Object.assign(new Error("aborted"), { name: "AbortError" }));
+    socket.destroy();
+    if (error) reject(error);
+    else if (response) resolve4(response);
   };
-  if (init?.signal) {
-    if (init.signal.aborted) {
-      abort();
-      return;
+  connectTimer = setTimeout(() => {
+    if (sent || settled) return;
+    finish(connectTimeoutError());
+  }, CONNECT_TIMEOUT_MS);
+  const onConnected = () => {
+    if (settled || sent) return;
+    sent = true;
+    if (connectTimer) {
+      clearTimeout(connectTimer);
+      connectTimer = void 0;
     }
-    init.signal.addEventListener("abort", abort, { once: true });
-  }
-  if (unrefSockets) {
-    req.on("socket", (socket) => {
-      socket.unref();
-    });
-  }
-  req.setTimeout(5e3, abort);
-  req.on("error", reject);
-  writeBody(req, init?.body ?? null);
+    try {
+      socket.write(encodeHttpRequest(parsed, init));
+    } catch (error) {
+      finish(error instanceof Error ? error : new Error(String(error)));
+    }
+  };
+  if (parsed.protocol === "https:") {
+    socket.once("secureConnect", onConnected);
+  } else {
+    socket.once("connect", onConnected);
+    if (socket.remoteAddress) onConnected();
+  }
+  init?.signal?.addEventListener("abort", () => finish(abortError()), { once: true });
+  if (init?.signal?.aborted) finish(abortError());
+  let buf = Buffer.alloc(0);
+  socket.on("data", (chunk) => {
+    buf = Buffer.concat([buf, chunk]);
+    try {
+      const response = tryParseHttpResponse(buf, false);
+      if (response) finish(null, response);
+    } catch (error) {
+      finish(error instanceof Error ? error : new Error(String(error)));
+    }
+  });
+  socket.on("end", () => {
+    try {
+      const response = tryParseHttpResponse(buf, true);
+      if (response) finish(null, response);
+      else finish(new Error("incomplete HTTP response"));
+    } catch (error) {
+      finish(error instanceof Error ? error : new Error(String(error)));
+    }
+  });
+  socket.on("error", (error) => finish(error));
 });
-var defaultIngestFetch = (options) => createNodeHttpFetch(options?.unrefSockets === true);
 
 // src/announce-deploy/announce-deploy.ts
 var trimmedString = (value) => typeof value === "string" ? value.trim() : "";
@@ -361,6 +437,257 @@ var finalizeResolution = (resolution, stackFrames) => {
   return "exact";
 };
 
+// src/derivation/rasputin-redacted.ts
+var RASPUTIN_REDACTED = "[RASPUTIN_REDACTED]";
+
+// src/derivation/sensitive-property-name.ts
+var DEFAULT_SENSITIVE_PROPERTY_NAMES = [
+  "password",
+  "passwd",
+  "pwd",
+  "passphrase",
+  "cookie",
+  "cookies",
+  "signedcookies",
+  "setcookie",
+  "secret",
+  "secrets",
+  "clientsecret",
+  "authorization",
+  "proxyauthorization",
+  "bearer"
+];
+var DEFAULT_SENSITIVE_PROPERTY_NAME_SET = new Set(DEFAULT_SENSITIVE_PROPERTY_NAMES);
+var SENSITIVE_SUFFIXES = [
+  "password",
+  "passwd",
+  "passphrase",
+  "pwd",
+  "cookie",
+  "cookies"
+];
+var compactKey = (key) => {
+  let compacted = "";
+  for (let index = 0; index < key.length; index++) {
+    const code = key.charCodeAt(index);
+    if (code === 45 || code === 46 || code === 95) continue;
+    compacted += code >= 65 && code <= 90 ? String.fromCharCode(code + 32) : key[index];
+  }
+  return compacted;
+};
+var stripTrailingDigits = (value) => {
+  let end = value.length;
+  while (end > 0) {
+    const code = value.charCodeAt(end - 1);
+    if (code < 48 || code > 57) break;
+    end--;
+  }
+  return end === 0 ? value : value.slice(0, end);
+};
+var defaultSensitivePropertyNames = () => DEFAULT_SENSITIVE_PROPERTY_NAME_SET;
+var propertyNameIsSensitive = (key) => {
+  const compacted = compactKey(key);
+  const compactForms = [compacted, stripTrailingDigits(compacted)].filter(
+    (value, index, values) => value.length > 0 && values.indexOf(value) === index
+  );
+  for (const form of compactForms) {
+    if (DEFAULT_SENSITIVE_PROPERTY_NAME_SET.has(form)) return true;
+    for (const suffix of SENSITIVE_SUFFIXES) {
+      if (form.endsWith(suffix)) return true;
+    }
+  }
+  return false;
+};
+
+// src/derivation/redact-env-secret-values.ts
+var MIN_ENV_SECRET_LENGTH = 6;
+var MAX_ENV_SECRET_NEEDLE_LENGTH = 512;
+var COMMON_CONFIG_VALUES = /* @__PURE__ */ new Set([
+  "enabled",
+  "disabled",
+  "production",
+  "development",
+  "staging",
+  "testing",
+  "localhost",
+  "undefined"
+]);
+var identityMatcher = {
+  redact: (text) => text,
+  needleCount: 0
+};
+var envKeyLooksSensitive = (key) => {
+  if (propertyNameIsSensitive(key)) return true;
+  const compact = key.replace(/[-._]/g, "").toLowerCase();
+  return compact.includes("accesskey") || compact.includes("apikey") || compact.endsWith("secret") || compact.endsWith("token") || compact.includes("privatekey");
+};
+var isCollectableSecretValue = (value) => value.length >= MIN_ENV_SECRET_LENGTH && !COMMON_CONFIG_VALUES.has(value.toLowerCase());
+var looksLikeUrl = (value) => {
+  const schemeEnd = value.indexOf("://");
+  return schemeEnd > 0 && schemeEnd < 32;
+};
+var urlUserinfo = (value) => {
+  const schemeEnd = value.indexOf("://");
+  if (schemeEnd <= 0) return void 0;
+  const rest = value.slice(schemeEnd + 3);
+  let authorityEnd = rest.length;
+  for (const marker of ["/", "?", "#"]) {
+    const at = rest.indexOf(marker);
+    if (at >= 0 && at < authorityEnd) authorityEnd = at;
+  }
+  const authority = rest.slice(0, authorityEnd);
+  const userinfoEnd = authority.lastIndexOf("@");
+  if (userinfoEnd < 0) return void 0;
+  const userinfo = authority.slice(0, userinfoEnd);
+  if (!userinfo) return void 0;
+  const colon = userinfo.indexOf(":");
+  const encodedPassword = colon < 0 ? "" : userinfo.slice(colon + 1);
+  if (!encodedPassword) return void 0;
+  let password = encodedPassword;
+  try {
+    password = decodeURIComponent(encodedPassword.replace(/\+/g, " "));
+  } catch {
+    password = encodedPassword;
+  }
+  return { password, encodedPassword, userinfo };
+};
+var querySecretValues = (value) => {
+  const queryAt = value.indexOf("?");
+  if (queryAt < 0) return [];
+  const hashAt = value.indexOf("#", queryAt + 1);
+  const query = hashAt < 0 ? value.slice(queryAt + 1) : value.slice(queryAt + 1, hashAt);
+  if (!query.includes("=")) return [];
+  const found = [];
+  const parts = query.split("&");
+  for (let index = 0; index < parts.length; index++) {
+    const part = parts[index];
+    if (!part) continue;
+    const equals = part.indexOf("=");
+    if (equals <= 0) continue;
+    const rawKey = part.slice(0, equals);
+    let key = rawKey;
+    try {
+      key = decodeURIComponent(rawKey.replace(/\+/g, " "));
+    } catch {
+      key = rawKey;
+    }
+    if (!propertyNameIsSensitive(key) && !propertyNameIsSensitive(rawKey)) continue;
+    const rawValue = part.slice(equals + 1);
+    if (!rawValue) continue;
+    found.push(rawValue);
+    try {
+      const decoded = decodeURIComponent(rawValue.replace(/\+/g, " "));
+      if (decoded !== rawValue) found.push(decoded);
+    } catch {
+    }
+  }
+  return found;
+};
+var addNeedle = (needles, value) => {
+  if (value.length < MIN_ENV_SECRET_LENGTH) return;
+  needles.add(
+    value.length > MAX_ENV_SECRET_NEEDLE_LENGTH ? value.slice(0, MAX_ENV_SECRET_NEEDLE_LENGTH) : value
+  );
+};
+var addWithRepresentations = (needles, value) => {
+  addNeedle(needles, value);
+  if (value.length > MAX_ENV_SECRET_NEEDLE_LENGTH) return;
+  try {
+    const encoded = encodeURIComponent(value);
+    if (encoded !== value) addNeedle(needles, encoded);
+    const plus = encoded.replace(/%20/g, "+");
+    if (plus !== encoded) addNeedle(needles, plus);
+  } catch {
+  }
+  try {
+    const jsonEscaped = JSON.stringify(value).slice(1, -1);
+    if (jsonEscaped !== value) addNeedle(needles, jsonEscaped);
+  } catch {
+  }
+};
+var collectEnvSecretValues = (env = process.env) => {
+  const needles = /* @__PURE__ */ new Set();
+  let keys;
+  try {
+    keys = Object.keys(env);
+  } catch {
+    return [];
+  }
+  for (let index = 0; index < keys.length; index++) {
+    const key = keys[index];
+    if (!key || key === "PWD") continue;
+    let value;
+    try {
+      value = env[key];
+    } catch {
+      continue;
+    }
+    if (typeof value !== "string" || value.length === 0) continue;
+    try {
+      const userinfo = urlUserinfo(value);
+      if (userinfo) {
+        addWithRepresentations(needles, userinfo.password);
+        if (userinfo.encodedPassword !== userinfo.password) {
+          addWithRepresentations(needles, userinfo.encodedPassword);
+        }
+        if (userinfo.userinfo.length >= MIN_ENV_SECRET_LENGTH) {
+          addWithRepresentations(needles, userinfo.userinfo);
+        }
+        addWithRepresentations(needles, value);
+      }
+      const queryValues = querySecretValues(value);
+      for (let queryIndex = 0; queryIndex < queryValues.length; queryIndex++) {
+        const part = queryValues[queryIndex];
+        if (part) addWithRepresentations(needles, part);
+      }
+      if (!envKeyLooksSensitive(key) || !isCollectableSecretValue(value)) continue;
+      if (looksLikeUrl(value) && !userinfo && queryValues.length === 0) continue;
+      addWithRepresentations(needles, value);
+    } catch {
+    }
+  }
+  return [...needles];
+};
+var createExactSecretMatcher = (secrets) => {
+  const unique = [];
+  const exact = /* @__PURE__ */ new Set();
+  for (let index = 0; index < secrets.length; index++) {
+    const secret = secrets[index];
+    if (!secret || secret.length < MIN_ENV_SECRET_LENGTH || exact.has(secret)) continue;
+    exact.add(secret);
+    unique.push(secret);
+  }
+  if (unique.length === 0) return identityMatcher;
+  unique.sort((left, right) => right.length - left.length);
+  const minLen = unique[unique.length - 1]?.length ?? MIN_ENV_SECRET_LENGTH;
+  return {
+    needleCount: unique.length,
+    redact(text) {
+      try {
+        if (text.length < minLen) return text;
+        if (exact.has(text)) return RASPUTIN_REDACTED;
+        let result = text;
+        for (let index = 0; index < unique.length; index++) {
+          const needle = unique[index];
+          if (!needle || result.length < needle.length) continue;
+          if (result.indexOf(needle) === -1) continue;
+          result = result.replaceAll(needle, RASPUTIN_REDACTED);
+        }
+        return result;
+      } catch {
+        return text;
+      }
+    }
+  };
+};
+var createEnvSecretMatcher = (env = process.env) => {
+  try {
+    return createExactSecretMatcher(collectEnvSecretValues(env));
+  } catch {
+    return identityMatcher;
+  }
+};
+
 // src/normalize-frames/normalize-frames.ts
 import { isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
@@ -808,13 +1135,7 @@ var resolveSourceMaps = async (frames) => {
 
 // src/sdk-meta.ts
 var SDK_NAME = "@rasputin-ai/core";
-var SDK_VERSION = "0.7.1";
-
-// src/suppression/identity-needs-message-template.ts
-var identityNeedsMessageTemplate = (type, code) => {
-  if (code != null && code !== "") return false;
-  return type === "Error";
-};
+var SDK_VERSION = "0.8.0";
 
 // src/suppression/parameterize-message.ts
 var MAX_INPUT_LENGTH = 8192;
@@ -872,10 +1193,6 @@ var RULES = [
   {
     token: "duration",
     pattern: /\b\d+(?:\.\d+)?\s?(?:ns|µs|us|ms|secs?|seconds?|mins?|minutes?|hrs?|hours?|days?)\b/giu
-  },
-  {
-    token: "id",
-    pattern: /\b(?=[a-z0-9]*[a-z])(?=[a-z0-9]*\d)[a-z0-9]{8,}\b/giu
   }
 ];
 var normalizeForIdentity = (normalized) => {
@@ -936,19 +1253,22 @@ var frameBurstParts = (frames) => {
   const inApp = collapsed.filter((frame) => frame.in_app);
   const selected = (inApp.length > 0 ? inApp : collapsed).slice(0, FRAME_COUNT);
   return selected.map((frame) => {
-    const file = preferredFile(frame);
+    const loc = frame.original ?? frame.generated;
     const fn = normalizeFunction(frame.function ?? frame.original?.name);
-    return `${file}:${fn}`;
+    return `${loc.file}:${fn}:${loc.line ?? ""}:${loc.column ?? ""}`;
   });
 };
-var computeBurstKey = (errorType, message, code, frames) => {
+var computeBurstKey = (errorType, message, code, frames, route, method) => {
   const parts = frameBurstParts(frames);
   const codePart = code ?? "";
-  let key = `${errorType}\0${codePart}\0${parts.join("\0")}`;
-  if (parts.length === 0 || identityNeedsMessageTemplate(errorType, code)) {
-    key += `\0${parameterizeMessage(message)}`;
-  }
-  return key;
+  return [
+    errorType,
+    codePart,
+    method ?? "",
+    route ?? "",
+    parameterizeMessage(message),
+    parts.join("\0")
+  ].join("\0");
 };
 
 // src/suppression/create-suppression.ts
@@ -999,9 +1319,12 @@ var createSuppression = (options = {}) => {
     windowStart: bucket.windowStart,
     windowEndMs,
     lastRelease: bucket.lastRelease,
+    lastRoute: bucket.lastRoute,
+    lastMethod: bucket.lastMethod,
     lastEnvironment: bucket.lastEnvironment,
     identity: bucket.identity,
-    captureRawFrames: bucket.captureRawFrames
+    captureRawFrames: bucket.captureRawFrames,
+    burstKey: bucket.burstKey
   });
   const toSummary = (draft, identity) => ({
     count: draft.count,
@@ -1009,7 +1332,8 @@ var createSuppression = (options = {}) => {
     window_end: new Date(draft.windowEndMs).toISOString(),
     release: draft.lastRelease,
     environment: draft.lastEnvironment,
-    ...identity
+    ...identity,
+    ...draft.lastRoute || draft.lastMethod ? { request: { route: draft.lastRoute, method: draft.lastMethod } } : {}
   });
   const flushSuppressed = (bucket, windowEndMs) => {
     if (bucket.suppressed <= 0) return;
@@ -1020,9 +1344,17 @@ var createSuppression = (options = {}) => {
     const now = input.now ?? Date.now();
     const identity = captureIdentity(input);
     const captureRawFrames = (input.rawFrames ?? []).slice(0, MAX_STACK_FRAMES);
-    const burstKey = computeBurstKey(input.errorType, input.message, input.code, input.frames);
+    const burstKey = computeBurstKey(
+      input.errorType,
+      input.message,
+      input.code,
+      input.frames,
+      input.route,
+      input.method
+    );
     const release = input.release;
     const route = input.route ?? null;
+    const method = input.method ?? null;
     let bucket = burstBuckets.get(burstKey);
     if (!bucket) {
       bucket = {
@@ -1031,9 +1363,11 @@ var createSuppression = (options = {}) => {
         windowStart: now,
         lastRelease: release,
         lastRoute: route,
+        lastMethod: method,
         lastEnvironment: input.environment,
         identity,
-        captureRawFrames
+        captureRawFrames,
+        burstKey
       };
       burstBuckets.set(burstKey, bucket);
       evictIfNeeded();
@@ -1048,6 +1382,7 @@ var createSuppression = (options = {}) => {
       bucket.windowStart = now;
       bucket.lastRelease = release;
       bucket.lastRoute = route;
+      bucket.lastMethod = method;
       bucket.lastEnvironment = input.environment;
       bucket.identity = identity;
       bucket.captureRawFrames = captureRawFrames;
@@ -1057,6 +1392,7 @@ var createSuppression = (options = {}) => {
       bucket.sentInWindow += 1;
       bucket.lastRelease = release;
       bucket.lastRoute = route;
+      bucket.lastMethod = method;
       bucket.lastEnvironment = input.environment;
       return { action: "send", priority: "repeat" };
     }
@@ -1073,7 +1409,8 @@ var createSuppression = (options = {}) => {
     }
     return drafts.map((draft) => ({
       summary: toSummary(draft, draft.identity),
-      rawFrames: draft.captureRawFrames
+      rawFrames: draft.captureRawFrames,
+      burstKey: draft.burstKey
     }));
   };
   const takeSummaries = async (now = Date.now(), prepareSummary) => {
@@ -1103,6 +1440,42 @@ var createSuppression = (options = {}) => {
   };
 };
 
+// src/suppression/grouping-ref-cache.ts
+var GROUPING_REF_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var createGroupingRefCache = (maxSize = 2e3) => {
+  const byBurstKey = /* @__PURE__ */ new Map();
+  const get = (burstKey, now = Date.now()) => {
+    const entry = byBurstKey.get(burstKey);
+    if (!entry || entry.expiresAt <= now) {
+      if (entry) byBurstKey.delete(burstKey);
+      return null;
+    }
+    byBurstKey.delete(burstKey);
+    byBurstKey.set(burstKey, entry);
+    return entry.groupingRef;
+  };
+  const set = (burstKey, groupingRef, now = Date.now()) => {
+    byBurstKey.delete(burstKey);
+    byBurstKey.set(burstKey, { groupingRef, expiresAt: now + GROUPING_REF_TTL_MS });
+    while (byBurstKey.size > maxSize) {
+      const oldest = byBurstKey.keys().next().value;
+      if (oldest === void 0) break;
+      byBurstKey.delete(oldest);
+    }
+  };
+  const getOrCreate = (burstKey, now = Date.now()) => {
+    const existing = get(burstKey, now);
+    if (existing) return existing;
+    const groupingRef = crypto.randomUUID();
+    set(burstKey, groupingRef, now);
+    return groupingRef;
+  };
+  return { get, set, getOrCreate };
+};
+
+// src/transport/default-ingest-request-timeout.ts
+var DEFAULT_INGEST_REQUEST_TIMEOUT_MS = 2e4;
+
 // src/transport/process-shutdown-hooks.ts
 var SIGNAL_EXIT_CODES = { SIGTERM: 143, SIGINT: 130 };
 var RASPUTIN_PROCESS_LISTENER = Symbol.for("rasputin.process.listener.v1");
@@ -1179,33 +1552,32 @@ var encodeJsonRequestBody = (payload, gzipThresholdBytes = GZIP_JSON_THRESHOLD_B
 
 // src/transport/send-batch.ts
 var sleep = (ms, signal) => new Promise((resolve4) => {
-  if (ms <= 0 || signal?.aborted) {
+  if (ms <= 0) {
     resolve4();
     return;
   }
   const timer = setTimeout(resolve4, ms);
   timer.unref?.();
-  signal?.addEventListener(
-    "abort",
-    () => {
-      clearTimeout(timer);
-      resolve4();
-    },
-    { once: true }
-  );
+  const onAbort = () => {
+    clearTimeout(timer);
+    resolve4();
+  };
+  signal.addEventListener("abort", onAbort, { once: true });
+  if (signal.aborted) onAbort();
 });
 var backoffMs = (attempt) => {
   const base = Math.min(3e4, 500 * 2 ** attempt);
   return Math.floor(base * (0.5 + Math.random()));
 };
-var abortError = () => Object.assign(new Error("aborted"), { name: "AbortError" });
+var abortError2 = () => Object.assign(new Error("aborted"), { name: "AbortError" });
 var fetchUntilAborted = (fetchFn, url, init) => new Promise((resolve4, reject) => {
+  const onAbort = () => reject(abortError2());
+  init.signal.addEventListener("abort", onAbort, { once: true });
   if (init.signal.aborted) {
-    reject(abortError());
+    init.signal.removeEventListener("abort", onAbort);
+    reject(abortError2());
     return;
   }
-  const onAbort = () => reject(abortError());
-  init.signal.addEventListener("abort", onAbort, { once: true });
   void fetchFn(url, init).then(
     (value) => {
       init.signal.removeEventListener("abort", onAbort);
@@ -1225,8 +1597,29 @@ var retryAfterMs = (response) => {
   const date = Date.parse(header);
   return Number.isFinite(date) ? Math.max(0, date - Date.now()) : null;
 };
+var asRefList = (value) => {
+  if (!Array.isArray(value)) return [];
+  return value.map((entry) => typeof entry === "string" ? entry : null);
+};
+var readGroupingRefs = async (response) => {
+  try {
+    const body = await response.json();
+    const payload = typeof body === "object" && body !== null && "payload" in body && typeof body.payload === "object" && body.payload !== null ? body.payload : body;
+    if (typeof payload !== "object" || payload === null) {
+      return { eventGroupingRefs: [], summaryGroupingRefs: [] };
+    }
+    const record = payload;
+    return {
+      eventGroupingRefs: asRefList(record.event_grouping_refs),
+      summaryGroupingRefs: asRefList(record.summary_grouping_refs)
+    };
+  } catch {
+    return { eventGroupingRefs: [], summaryGroupingRefs: [] };
+  }
+};
 var sendBatch = async (options) => {
   const summaries = options.summaries ?? [];
+  const { signal } = options;
   let payload;
   if (summaries.length > 0) {
     payload = { events: options.events, summaries };
@@ -1235,12 +1628,13 @@ var sendBatch = async (options) => {
   }
   if (options.sdkVersion) payload.sdk_version = options.sdkVersion;
   if (options.sdkName) payload.sdk_name = options.sdkName;
+  payload.scrub_pii = options.scrubPii !== false;
   if (options.idempotencyKey) payload.idempotency_key = options.idempotencyKey;
   let attempts = 0;
   let networkErrors = 0;
   let rateLimitedResponses = 0;
   let serverErrorResponses = 0;
-  const result = (outcome, failureKind = null, statusCode = null) => ({
+  const result = (outcome, failureKind = null, statusCode = null, eventGroupingRefs = [], summaryGroupingRefs = []) => ({
     outcome,
     attempts,
     retries: Math.max(0, attempts - 1),
@@ -1249,15 +1643,10 @@ var sendBatch = async (options) => {
     serverErrorResponses,
     aborted: failureKind === "aborted",
     failureKind,
-    statusCode
+    statusCode,
+    eventGroupingRefs,
+    summaryGroupingRefs
   });
-  const abortAfter = (ms) => {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), ms);
-    timer.unref?.();
-    return { signal: controller.signal, cancel: () => clearTimeout(timer) };
-  };
-  const requestTimeoutMs = options.requestTimeoutMs ?? 5e3;
   const { body, gzip } = encodeJsonRequestBody(payload, options.gzipThresholdBytes);
   const headers = {
     Authorization: `Bearer ${options.projectApiKey}`,
@@ -1266,10 +1655,8 @@ var sendBatch = async (options) => {
   };
   if (gzip) headers["Content-Encoding"] = "gzip";
   for (let attempt = 0; attempt <= options.maxRetries; attempt++) {
-    if (options.signal?.aborted) return result("failed", "aborted");
+    if (signal.aborted) return result("failed", "aborted");
     attempts++;
-    const timeout = abortAfter(requestTimeoutMs);
-    const signal = options.signal ? AbortSignal.any([options.signal, timeout.signal]) : timeout.signal;
     try {
       const response = await fetchUntilAborted(options.fetch, options.ingestUrl, {
         method: "POST",
@@ -1277,13 +1664,22 @@ var sendBatch = async (options) => {
         body,
         signal
       });
-      if (response.ok) return result("ok");
+      if (response.ok) {
+        const refs = await readGroupingRefs(response);
+        return result(
+          "ok",
+          null,
+          response.status,
+          refs.eventGroupingRefs,
+          refs.summaryGroupingRefs
+        );
+      }
       if (response.status === 429) {
         rateLimitedResponses++;
         if (attempt === options.maxRetries)
           return result("failed", "rate_limited", response.status);
         const wait = retryAfterMs(response) ?? backoffMs(attempt);
-        await sleep(wait, options.signal);
+        await sleep(wait, signal);
         continue;
       }
       if (response.status >= 400 && response.status < 500) {
@@ -1291,19 +1687,17 @@ var sendBatch = async (options) => {
       }
       serverErrorResponses++;
       if (attempt === options.maxRetries) return result("failed", "server_error", response.status);
-      await sleep(backoffMs(attempt), options.signal);
+      await sleep(backoffMs(attempt), signal);
     } catch (error) {
       if (signal.aborted || error instanceof Error && error.name === "AbortError") {
         return result("failed", "aborted");
       }
       networkErrors++;
       if (attempt === options.maxRetries) return result("failed", "network_error");
-      await sleep(backoffMs(attempt), options.signal);
-    } finally {
-      timeout.cancel();
+      await sleep(backoffMs(attempt), signal);
     }
   }
-  return result("failed", options.signal?.aborted ? "aborted" : "network_error");
+  return result("failed", signal.aborted ? "aborted" : "network_error");
 };
 
 // src/transport/transport-queue.ts
@@ -1430,9 +1824,8 @@ var createTransport = (options) => {
   const flushIntervalMs = options.flushIntervalMs ?? DEFAULTS2.flushIntervalMs;
   const gzipThresholdBytes = options.gzipThresholdBytes ?? DEFAULTS2.gzipThresholdBytes;
   const maxRetries = options.maxRetries ?? DEFAULTS2.maxRetries;
-  const requestTimeoutMs = options.requestTimeoutMs ?? 5e3;
+  const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_INGEST_REQUEST_TIMEOUT_MS;
   const fetchFn = options.fetch ?? defaultIngestFetch();
-  const backgroundFetch = options.fetch ?? defaultIngestFetch({ unrefSockets: true });
   const queue = createQueue(
     options.maxQueueSize ?? DEFAULTS2.maxQueueSize,
     options.maxQueueBytes ?? DEFAULTS2.maxQueueBytes
@@ -1460,6 +1853,7 @@ var createTransport = (options) => {
   let flushAbort;
   let flushAbortTimer;
   let flushDeadlineMs = 0;
+  let flushHoldsProcess = false;
   let inFlightBytes = 0;
   let retryBytes = 0;
   const estimateItemsBytes = (items) => {
@@ -1474,23 +1868,30 @@ var createTransport = (options) => {
   };
   const setFlushDeadline = (timeoutMs, holdProcess = false) => {
     const nextDeadline = timeoutMs > 0 ? Date.now() + timeoutMs : Number.POSITIVE_INFINITY;
-    if (flushAbort && nextDeadline >= flushDeadlineMs) return;
-    flushDeadlineMs = nextDeadline;
-    if (!flushAbort) flushAbort = new AbortController();
+    if (holdProcess) flushHoldsProcess = true;
+    const shouldReplace = !flushAbort || nextDeadline < flushDeadlineMs;
+    if (!shouldReplace && !holdProcess) return;
+    if (shouldReplace) {
+      flushDeadlineMs = nextDeadline;
+      if (!flushAbort) flushAbort = new AbortController();
+    }
     if (flushAbortTimer) clearTimeout(flushAbortTimer);
-    if (Number.isFinite(nextDeadline)) {
-      flushAbortTimer = setTimeout(
-        () => flushAbort?.abort(),
-        Math.max(0, nextDeadline - Date.now())
-      );
-      if (!holdProcess) flushAbortTimer.unref?.();
+    if (!Number.isFinite(flushDeadlineMs)) {
+      flushAbortTimer = void 0;
+      return;
     }
+    flushAbortTimer = setTimeout(
+      () => flushAbort?.abort(),
+      Math.max(0, flushDeadlineMs - Date.now())
+    );
+    if (!flushHoldsProcess) flushAbortTimer.unref?.();
   };
   const clearFlushDeadline = () => {
     if (flushAbortTimer) clearTimeout(flushAbortTimer);
     flushAbortTimer = void 0;
     flushAbort = void 0;
     flushDeadlineMs = 0;
+    flushHoldsProcess = false;
   };
   const schedule = () => {
     if (timer || startTimer || !enabled || closed || shuttingDown2) return;
@@ -1529,11 +1930,8 @@ var createTransport = (options) => {
   };
   const whenAborted = (signal) => new Promise((_, reject) => {
     const abort = () => reject(signal.reason ?? new Error("aborted"));
-    if (signal.aborted) {
-      abort();
-      return;
-    }
     signal.addEventListener("abort", abort, { once: true });
+    if (signal.aborted) abort();
   });
   const performFlush = async () => {
     options.beforeFlush?.();
@@ -1587,15 +1985,15 @@ var createTransport = (options) => {
           }
         }
         const retainOrDrop = (nextReplays, createdAt) => {
+          inFlightBytes = 0;
           if (nextReplays >= DEFAULTS2.maxBatchReplays || Date.now() - createdAt >= DEFAULTS2.maxRetryBatchAgeMs) {
             batchesDropped++;
             retryBatch = null;
             retryBytes = 0;
           } else {
             retryBatch = { items: batch, idempotencyKey, createdAt, replays: nextReplays };
-            retryBytes = inFlightBytes;
+            retryBytes = estimateItemsBytes(batch);
           }
-          inFlightBytes = 0;
           syncReservedBytes();
         };
         if (controller.signal.aborted) {
@@ -1610,10 +2008,10 @@ var createTransport = (options) => {
           idempotencyKey,
           sdkVersion: options.sdkVersion,
           sdkName: options.sdkName,
+          scrubPii: options.scrubPii,
           gzipThresholdBytes,
           maxRetries: shuttingDown2 ? 0 : maxRetries,
-          requestTimeoutMs,
-          fetch: shuttingDown2 ? fetchFn : backgroundFetch,
+          fetch: fetchFn,
           signal: controller.signal
         });
         sendAttempts += result.attempts;
@@ -1622,8 +2020,21 @@ var createTransport = (options) => {
         rateLimitedResponses += result.rateLimitedResponses;
         serverErrorResponses += result.serverErrorResponses;
         if (result.aborted) flushTimeouts++;
-        if (result.outcome === "ok") batchesSucceeded++;
-        else {
+        if (result.outcome === "ok") {
+          batchesSucceeded++;
+          const eventBurstKeys = [];
+          const summaryBurstKeys = [];
+          for (const item of batch) {
+            if (item.kind === "event") eventBurstKeys.push(item.burstKey);
+            else summaryBurstKeys.push(item.burstKey);
+          }
+          options.onGroupingRefs?.({
+            eventBurstKeys,
+            summaryBurstKeys,
+            eventGroupingRefs: result.eventGroupingRefs,
+            summaryGroupingRefs: result.summaryGroupingRefs
+          });
+        } else {
           lastFailureKind = result.failureKind;
           lastFailureStatusCode = result.statusCode;
           if (result.outcome === "dropped") batchesDropped++;
@@ -1679,15 +2090,15 @@ var createTransport = (options) => {
     }
     await startFlushWorker();
   };
-  const enqueue = (event, priority = "first", rawFrames = [], encodedBytes) => {
+  const enqueue = (event, priority = "first", rawFrames = [], encodedBytes, burstKey) => {
     if (!enabled || closed) return;
-    queue.enqueue({ kind: "event", event, priority, rawFrames, encodedBytes });
+    queue.enqueue({ kind: "event", event, priority, rawFrames, encodedBytes, burstKey });
     schedule();
     if (queue.size() >= batchSize) kickBackgroundFlush();
   };
-  const enqueueSummary = (summary, rawFrames = []) => {
+  const enqueueSummary = (summary, rawFrames = [], burstKey) => {
     if (!enabled || closed) return;
-    queue.enqueue({ kind: "summary", summary, priority: "summary", rawFrames });
+    queue.enqueue({ kind: "summary", summary, priority: "summary", rawFrames, burstKey });
     schedule();
     if (queue.size() >= batchSize) kickBackgroundFlush();
   };
@@ -1730,21 +2141,10 @@ var createTransport = (options) => {
     stopTimer();
     unregisterSignals();
     shuttingDown2 = true;
-    await new Promise((resolve4, reject) => {
-      const timer2 = setTimeout(resolve4, DEFAULTS2.shutdownFlushMs + 250);
-      void flush(DEFAULTS2.shutdownFlushMs).then(
-        () => {
-          clearTimeout(timer2);
-          resolve4();
-        },
-        (error) => {
-          clearTimeout(timer2);
-          reject(error);
-        }
-      );
+    await flush(DEFAULTS2.shutdownFlushMs).catch(() => {
     });
-    dropRemainingOnExit();
     closed = true;
+    dropRemainingOnExit();
     queue.clear();
     retryBatch = null;
   };
@@ -1937,6 +2337,7 @@ var createClient = (options, hooks = {}) => {
     const activation = resolveClientActivation(options);
     if (!activation.enabled) return noopClient();
     const { ingestToken, projectApiKey, apiUrl, release } = activation;
+    const redactEnvSecrets = createEnvSecretMatcher().redact;
     const environment = options.environment;
     const { ingestUrl, deployUrl } = resolveEndpointUrls(apiUrl);
     const repoRoot = resolveRepoRoot(options);
@@ -1965,6 +2366,7 @@ var createClient = (options, hooks = {}) => {
       return pending;
     };
     const suppression = createSuppression();
+    const groupingRefs = createGroupingRefCache();
     let enqueuePendingSummaries = () => {
     };
     const transport = createTransport({
@@ -1975,7 +2377,23 @@ var createClient = (options, hooks = {}) => {
       installSignalHandlers: hooks.installTransportSignalHandlers,
       sdkVersion: hooks.sdkVersion ?? SDK_VERSION,
       sdkName: hooks.sdkName ?? SDK_NAME,
+      scrubPii: options.scrubPII !== false,
       beforeFlush: () => enqueuePendingSummaries(),
+      onGroupingRefs: ({
+        eventBurstKeys,
+        summaryBurstKeys,
+        eventGroupingRefs,
+        summaryGroupingRefs
+      }) => {
+        for (const [index, burstKey] of eventBurstKeys.entries()) {
+          const groupingRef = eventGroupingRefs[index];
+          if (burstKey && groupingRef) groupingRefs.set(burstKey, groupingRef);
+        }
+        for (const [index, burstKey] of summaryBurstKeys.entries()) {
+          const groupingRef = summaryGroupingRefs[index];
+          if (burstKey && groupingRef) groupingRefs.set(burstKey, groupingRef);
+        }
+      },
       prepareEvent: async ({ event, rawFrames }) => {
         const prepared = await resolveStack(rawFrames);
         return withResolvedFrames(event, prepared.frames, prepared.resolution);
@@ -2008,6 +2426,17 @@ var createClient = (options, hooks = {}) => {
           resolution: "none",
           request: context?.request
         });
+        event.message = redactEnvSecrets(event.message);
+        const burstKey = computeBurstKey(
+          event.type,
+          event.message,
+          event.code,
+          frames,
+          context?.request?.route,
+          context?.request?.method
+        );
+        const groupingRef = groupingRefs.getOrCreate(burstKey);
+        event.grouping_ref = groupingRef;
         const decision = suppression.decide({
           errorType: event.type,
           message: event.message,
@@ -2017,7 +2446,8 @@ var createClient = (options, hooks = {}) => {
           code: event.code,
           environment,
           release,
-          route: context?.request?.route
+          route: context?.request?.route,
+          method: context?.request?.method
         });
         if (decision.action !== "send") return;
         const runtimeState = resolveRuntimeEvidence(context, hooks);
@@ -2028,13 +2458,15 @@ var createClient = (options, hooks = {}) => {
         } catch {
           encodedBytes = void 0;
         }
-        transport.enqueue(event, decision.priority, rawFrames, encodedBytes);
+        transport.enqueue(event, decision.priority, rawFrames, encodedBytes, burstKey);
       } catch {
       }
     };
     enqueuePendingSummaries = () => {
-      for (const { summary, rawFrames } of suppression.drainSummaries()) {
-        transport.enqueueSummary(summary, rawFrames);
+      for (const { summary, rawFrames, burstKey } of suppression.drainSummaries()) {
+        const groupingRef = groupingRefs.getOrCreate(burstKey);
+        summary.grouping_ref = groupingRef;
+        transport.enqueueSummary(summary, rawFrames, burstKey);
       }
     };
     const flush = async (timeoutMs) => {
@@ -2139,169 +2571,6 @@ var isRasputinTaggedValue = (value) => {
 };
 var rasputinTagKind = (value) => isRasputinTaggedValue(value) ? value[1] : void 0;
 
-// src/derivation/sensitive-property-name.ts
-var DEFAULT_SENSITIVE_PROPERTY_NAMES = [
-  "password",
-  "passwd",
-  "pwd",
-  "passphrase",
-  "token",
-  "accesstoken",
-  "refreshtoken",
-  "sessiontoken",
-  "authorization",
-  "auth",
-  "bearer",
-  "cookie",
-  "cookies",
-  "signedcookies",
-  "setcookie",
-  "secret",
-  "secrets",
-  "clientsecret",
-  "apikey",
-  "xapikey",
-  "credential",
-  "credentials",
-  "privatekey",
-  "privkey",
-  "pem",
-  "jwt",
-  "otp",
-  "totp",
-  "pin",
-  "mfacode",
-  "sessionid",
-  "sid",
-  "databaseurl",
-  "connectionstring",
-  "dsn",
-  "mongouri",
-  "redisurl",
-  "signingkey",
-  "encryptionkey",
-  "cvv",
-  "cvc",
-  "cardnumber",
-  "ssn",
-  "creditcard",
-  "securitycode",
-  "twofactorcode",
-  "masterkey",
-  "servicerolekey",
-  "stripekey",
-  "rawheaders"
-];
-var DEFAULT_SENSITIVE_PROPERTY_NAME_SET = new Set(DEFAULT_SENSITIVE_PROPERTY_NAMES);
-var SENSITIVE_SEGMENTS = /* @__PURE__ */ new Set([
-  "password",
-  "passwd",
-  "pwd",
-  "passphrase",
-  "token",
-  "secret",
-  "cookie",
-  "cookies",
-  "authorization",
-  "auth",
-  "bearer",
-  "credential",
-  "credentials",
-  "jwt",
-  "otp",
-  "totp",
-  "pin",
-  "sid",
-  "dsn",
-  "pem",
-  "privkey",
-  "cvv",
-  "cvc",
-  "ssn",
-  "secrets"
-]);
-var SENSITIVE_SUFFIXES = [
-  "password",
-  "passwd",
-  "token",
-  "secret",
-  "apikey",
-  "privatekey",
-  "credential",
-  "credentials",
-  "cookie"
-];
-var compactKey = (key) => {
-  let compacted = "";
-  for (let index = 0; index < key.length; index++) {
-    const code = key.charCodeAt(index);
-    if (code === 45 || code === 46 || code === 95) continue;
-    compacted += code >= 65 && code <= 90 ? String.fromCharCode(code + 32) : key[index];
-  }
-  return compacted;
-};
-var stripTrailingDigits = (value) => {
-  let end = value.length;
-  while (end > 0) {
-    const code = value.charCodeAt(end - 1);
-    if (code < 48 || code > 57) break;
-    end--;
-  }
-  return end === 0 ? value : value.slice(0, end);
-};
-var segmentsOf = (key) => {
-  const segments = [];
-  let current = "";
-  for (let index = 0; index < key.length; index++) {
-    const char = key[index] ?? "";
-    const code = key.charCodeAt(index);
-    if (code === 45 || code === 46 || code === 95) {
-      if (current) segments.push(current.toLowerCase());
-      current = "";
-      continue;
-    }
-    if (current && code >= 65 && code <= 90) {
-      const prev = current.charCodeAt(current.length - 1);
-      const prevIsLower = prev >= 97 && prev <= 122;
-      const next = key.charCodeAt(index + 1);
-      const nextIsLower = next >= 97 && next <= 122;
-      if (prevIsLower || nextIsLower) {
-        segments.push(current.toLowerCase());
-        current = char;
-        continue;
-      }
-    }
-    current += char;
-  }
-  if (current) segments.push(current.toLowerCase());
-  return segments;
-};
-var adjacentPairsSensitive = (left, right) => left === "api" && right === "key" || left === "private" && right === "key" || left === "client" && right === "secret" || left === "set" && right === "cookie" || left === "database" && right === "url" || left === "connection" && right === "string" || left === "mongo" && (right === "uri" || right === "url") || left === "mongodb" && (right === "uri" || right === "url") || left === "redis" && (right === "uri" || right === "url") || left === "postgres" && (right === "uri" || right === "url") || left === "database" && right === "uri" || left === "signing" && right === "key" || left === "master" && right === "key" || left === "stripe" && right === "key" || left === "service" && right === "role" || left === "security" && right === "code" || left === "two" && right === "factor" || left === "encryption" && right === "key" || left === "session" && (right === "id" || right === "key" || right === "token") || left === "card" && right === "number" || left === "mfa" && right === "code";
-var defaultSensitivePropertyNames = () => DEFAULT_SENSITIVE_PROPERTY_NAME_SET;
-var propertyNameIsSensitive = (key) => {
-  const compacted = compactKey(key);
-  const compactForms = [compacted, stripTrailingDigits(compacted)].filter(
-    (value, index, values) => value.length > 0 && values.indexOf(value) === index
-  );
-  for (const form of compactForms) {
-    if (DEFAULT_SENSITIVE_PROPERTY_NAME_SET.has(form)) return true;
-    for (const suffix of SENSITIVE_SUFFIXES) {
-      if (form.endsWith(suffix)) return true;
-    }
-    if (form.includes("apikey") || form.includes("xapikey")) return true;
-  }
-  const segments = segmentsOf(key).map((segment) => stripTrailingDigits(segment) || segment);
-  for (const segment of segments) {
-    if (SENSITIVE_SEGMENTS.has(segment)) return true;
-  }
-  for (let index = 0; index < segments.length - 1; index++) {
-    const left = segments[index];
-    const right = segments[index + 1];
-    if (left && right && adjacentPairsSensitive(left, right)) return true;
-  }
-  return false;
-};
-
 // src/instrumentation-manifest/instrumentation-manifest-types.ts
 var INSTRUMENTATION_MANIFEST_SCHEMA_VERSION = 3;
 
@@ -2333,9 +2602,12 @@ var uploadInstrumentationManifest = async (options) => {
 };
 export {
   INSTRUMENTATION_MANIFEST_SCHEMA_VERSION,
+  MAX_ENV_SECRET_NEEDLE_LENGTH,
+  RASPUTIN_REDACTED,
   RASPUTIN_WIRE_TAG,
   announceDeploy,
   createClient,
+  createEnvSecretMatcher,
   createIngestEvent,
   createSuppression,
   createTransport,