@realuptime/errors 0.4.0 → 0.5.0

package/README.md

@@ -3,7 +3,7 @@
 Zero-dependency error tracking SDK for JavaScript and Node: part of
 [RealUptime Errors](https://realuptime.io/error-tracking).
 
-This is a **mirror**. It is published from `packages/errors-js` in the
+This is a **mirror**. It is published from `errors-js` in the
 [realuptime monorepo](https://github.com/RealUptimeHQ/realuptime) by
 `scripts/publish-sdk-mirrors.mjs` and is not edited directly; open issues
 and PRs against this repo, but expect source changes to land here after
@@ -107,7 +107,7 @@ extra build step or type-stripping flag on the consumer's side.
 
 ## Version
 
-This mirror tracks SDK_VERSION `0.4.0` in `index.ts`, the string every
+This mirror tracks SDK_VERSION `0.5.0` in `index.ts`, the string every
 event actually carries on the wire.
 
 ## License

package/client.ts

@@ -3,7 +3,7 @@ import { MAX_EVENTS_PER_BATCH, type WireBatch, type WireEvent, type WireIngestRe
 
 /**
  * Delivery: batched, buffered, backed off, and incapable of crashing the
- * host app (docs/errors-plan.md, "The SDKs"). Disciplines inherited from
+ * host app (the internal-docs repo's errors-plan.md, "The SDKs"). Disciplines inherited from
  * apps/agent/api.ts and runtime.ts:
  *
  *   - Failures never throw out of the SDK. Everything is caught; the first
@@ -52,8 +52,16 @@ export class Transport {
   private loggedKinds = new Set<string>();
   private inFlight: Promise<void> | null = null;
 
-  constructor(private readonly options: TransportOptions) {
-    this.fetchImpl = options.fetchImpl ?? fetch;
+  // Explicit fields, not parameter properties: strip-only TS mode (the
+  // probe runtime) cannot execute parameter properties.
+  private readonly options: TransportOptions;
+  constructor(options: TransportOptions) {
+    this.options = options;
+    // A bare `fetch` reference called as `this.fetchImpl(...)` loses its
+    // window binding and throws "Illegal invocation" in every browser (Node
+    // does not care, which is why server-side use and the mocked tests never
+    // saw it). Bind explicitly.
+    this.fetchImpl = options.fetchImpl ?? ((...args: Parameters<typeof fetch>) => fetch(...args));
     this.now = options.now ?? Date.now;
     this.log = options.log ?? ((message) => console.error(message));
   }

package/dist/client.d.ts

@@ -1,7 +1,7 @@
 import { type WireEvent } from "./types.ts";
 /**
  * Delivery: batched, buffered, backed off, and incapable of crashing the
- * host app (docs/errors-plan.md, "The SDKs"). Disciplines inherited from
+ * host app (the internal-docs repo's errors-plan.md, "The SDKs"). Disciplines inherited from
  * apps/agent/api.ts and runtime.ts:
  *
  *   - Failures never throw out of the SDK. Everything is caught; the first
@@ -30,7 +30,6 @@ export interface TransportOptions {
     log?: (message: string) => void;
 }
 export declare class Transport {
-    private readonly options;
     private readonly buffer;
     private readonly fetchImpl;
     private readonly now;
@@ -41,6 +40,7 @@ export declare class Transport {
     private disabled;
     private loggedKinds;
     private inFlight;
+    private readonly options;
     constructor(options: TransportOptions);
     enqueue(event: WireEvent): void;
     /** Sends what is due. Serialized: one delivery in flight at a time, so a

package/dist/client.js

@@ -2,7 +2,7 @@ import { EventBuffer } from "./buffer.js";
 import { MAX_EVENTS_PER_BATCH } from "./types.js";
 /**
  * Delivery: batched, buffered, backed off, and incapable of crashing the
- * host app (docs/errors-plan.md, "The SDKs"). Disciplines inherited from
+ * host app (the internal-docs repo's errors-plan.md, "The SDKs"). Disciplines inherited from
  * apps/agent/api.ts and runtime.ts:
  *
  *   - Failures never throw out of the SDK. Everything is caught; the first
@@ -24,7 +24,6 @@ export const SEND_TIMEOUT_MS = 10_000;
 export const BACKOFF_START_MS = 5_000;
 export const BACKOFF_MAX_MS = 300_000;
 export class Transport {
-    options;
     buffer = new EventBuffer();
     fetchImpl;
     now;
@@ -35,9 +34,16 @@ export class Transport {
     disabled = false;
     loggedKinds = new Set();
     inFlight = null;
+    // Explicit fields, not parameter properties: strip-only TS mode (the
+    // probe runtime) cannot execute parameter properties.
+    options;
     constructor(options) {
         this.options = options;
-        this.fetchImpl = options.fetchImpl ?? fetch;
+        // A bare `fetch` reference called as `this.fetchImpl(...)` loses its
+        // window binding and throws "Illegal invocation" in every browser (Node
+        // does not care, which is why server-side use and the mocked tests never
+        // saw it). Bind explicitly.
+        this.fetchImpl = options.fetchImpl ?? ((...args) => fetch(...args));
         this.now = options.now ?? Date.now;
         this.log = options.log ?? ((message) => console.error(message));
     }

package/dist/index.d.ts

@@ -1,10 +1,11 @@
 import { type FeedbackOptions, type ReportDialogHandle, type ReportDialogOptions } from "./feedback.ts";
 export type { FeedbackOptions, ReportDialogField, ReportDialogHandle, ReportDialogOptions, ReportDialogTheme } from "./feedback.ts";
+export type { WireEvent } from "./types.ts";
 import { type CustomScrubRule } from "./custom-scrub.ts";
-import { type WireFrame, type WireRequest, type WireUser } from "./types.ts";
+import { type ErrorLevel, type WireEvent, type WireFrame, type WireRequest, type WireUser } from "./types.ts";
 /**
  * @realuptime/errors: minimal JS/Node error tracking SDK, Phase 1
- * (docs/errors-plan.md). Captures unhandled exceptions and rejections plus
+ * (the internal-docs repo's errors-plan.md). Captures unhandled exceptions and rejections plus
  * manual `captureException`/`captureMessage`, scrubs PII client-side by
  * default (scrub.ts), and posts to the project's DSN-style ingest endpoint.
  *
@@ -14,13 +15,13 @@ import { type WireFrame, type WireRequest, type WireUser } from "./types.ts";
  * none.
  */
 export declare const SDK_NAME = "realuptime-errors-js";
-export declare const SDK_VERSION = "0.4.0";
+export declare const SDK_VERSION = "0.5.0";
 /** How long the one-time rules fetch may take before the SDK stops waiting
  * for it (it was never blocking capture anyway). */
 export declare const SCRUB_RULES_TIMEOUT_MS = 5000;
 export interface ErrorsInit {
     /** The project's ingest URL, e.g.
-     * `https://realuptime.io/api/errors/v1/ingest/rue_...`. Shown once at
+     * `https://ingest.realuptime.io/api/errors/v1/ingest/rue_...`. Shown once at
      * project creation; safe to embed client-side (it can only submit events
      * to its one project). */
     dsn: string;
@@ -59,11 +60,27 @@ export interface ErrorsInit {
      * switch in realuptime Errors settings must ALSO be on, or the endpoint
      * refuses with `reason: "feedback_disabled"`. See feedback.ts. */
     feedback?: FeedbackOptions;
+    /** A last look at every event before it is queued: return the event to
+     * send (the same object or a new one), or null to drop it. Runs AFTER the
+     * default scrub and any additional scrub rules, so it sees exactly what
+     * would otherwise leave and can only narrow it further. Fails closed: a
+     * hook that throws drops the event (logged once) rather than letting it
+     * through unfiltered, because a hook installed to remove data must never
+     * turn into the reason that data leaves. */
+    beforeSend?: (event: WireEvent) => WireEvent | null;
     /** Test seams. */
     fetchImpl?: typeof fetch;
     now?: () => number;
     log?: (message: string) => void;
 }
+/**
+ * Whether error reporting is actually on: `init()` was called with a dsn
+ * that passed `isIngestUrl`. A host process should log this once at
+ * startup (`realuptimeErrors.isEnabled()`) rather than assume that wiring
+ * `init()` into the code means events are flowing -- REA-575 was exactly
+ * that assumption, wrong for months because nothing checked it.
+ */
+export declare function isEnabled(): boolean;
 /** Parses a V8/JavaScriptCore/SpiderMonkey stack string into wire frames,
  * innermost first. Best-effort: an unparseable line is skipped, never
  * fatal. */
@@ -79,6 +96,9 @@ export interface CaptureContext {
     tags?: Record<string, string>;
     /** v2: custom context for THIS event only, merged over the sticky scope. */
     context?: Record<string, string>;
+    /** REA-569: severity for THIS event only. No sticky/init() equivalent --
+     * see WireEvent.level's doc for why. */
+    level?: ErrorLevel;
 }
 /**
  * v2 (REA-182): sets the sticky identity applied to every subsequent event.

package/dist/index.js

@@ -5,7 +5,7 @@ import { applyCustomScrubRules, compileCustomScrubRules, NO_CUSTOM_SCRUB_RULES,
 import { MAX_BREADCRUMB_DATA_ENTRIES, MAX_BREADCRUMBS_PER_EVENT, MAX_CONTEXT_ENTRIES, MAX_CONTEXT_KEY_LENGTH, MAX_FRAMES_PER_EVENT, MAX_MESSAGE_LENGTH, MAX_STRING_LENGTH, MAX_TAGS_PER_EVENT, } from "./types.js";
 /**
  * @realuptime/errors: minimal JS/Node error tracking SDK, Phase 1
- * (docs/errors-plan.md). Captures unhandled exceptions and rejections plus
+ * (the internal-docs repo's errors-plan.md). Captures unhandled exceptions and rejections plus
  * manual `captureException`/`captureMessage`, scrubs PII client-side by
  * default (scrub.ts), and posts to the project's DSN-style ingest endpoint.
  *
@@ -15,12 +15,13 @@ import { MAX_BREADCRUMB_DATA_ENTRIES, MAX_BREADCRUMBS_PER_EVENT, MAX_CONTEXT_ENT
  * none.
  */
 export const SDK_NAME = "realuptime-errors-js";
-export const SDK_VERSION = "0.4.0";
+export const SDK_VERSION = "0.5.0";
 /** How long the one-time rules fetch may take before the SDK stops waiting
  * for it (it was never blocking capture anyway). */
 export const SCRUB_RULES_TIMEOUT_MS = 5_000;
 let state = null;
 let initFailureLogged = false;
+let beforeSendFailureLogged = false;
 function safeLog(message) {
     try {
         (state?.options.log ?? console.error)(`[realuptime-errors] ${message}`);
@@ -29,6 +30,41 @@ function safeLog(message) {
         // Even logging must not throw.
     }
 }
+/** The ingest route's path shape: `/api/errors/v1/ingest/<key>`, an
+ * optional trailing slash, nothing else. Mirrors the marker check in
+ * feedback.ts/custom-scrub.ts and the stricter parse in sourcemaps.ts. */
+const INGEST_PATH_RE = /^\/api\/errors\/v1\/ingest\/[^/?#]+\/?$/;
+/**
+ * REA-575: a `dsn` must be the full ingest URL the server hands out at
+ * project creation, not the bare `rue_...` key alone. Before this check,
+ * `init()` accepted any non-empty string and handed it straight to the
+ * transport as the fetch endpoint: a bare key is not a fetchable URL, so
+ * every send failed inside the transport's own never-throw try/catch and
+ * the SDK silently reported nothing, forever, with no signal anywhere
+ * (realuptime-web's own DSN held exactly this mistake in production).
+ */
+function isIngestUrl(dsn) {
+    let url;
+    try {
+        url = new URL(dsn);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        return false;
+    return INGEST_PATH_RE.test(url.pathname);
+}
+/**
+ * Whether error reporting is actually on: `init()` was called with a dsn
+ * that passed `isIngestUrl`. A host process should log this once at
+ * startup (`realuptimeErrors.isEnabled()`) rather than assume that wiring
+ * `init()` into the code means events are flowing -- REA-575 was exactly
+ * that assumption, wrong for months because nothing checked it.
+ */
+export function isEnabled() {
+    return state !== null;
+}
 function clip(value, max) {
     return value.length > max ? value.slice(0, max) : value;
 }
@@ -240,6 +276,7 @@ function buildEvent(message, exceptionType, stack, context) {
         // REA-257: minted only when feedback is enabled, so an integration that
         // never opted in keeps emitting the id-less payload it always did.
         ...(state?.feedback ? { eventId: mintEventId() } : {}),
+        ...(context.level ? { level: context.level } : {}),
     };
 }
 /**
@@ -281,10 +318,30 @@ function capture(event) {
         return null;
     // Defaults first, always; the customer's additional rules on the result.
     const scrubbed = scrubEvent(event, state.options.allowFields ?? []);
-    state.transport.enqueue(applyCustomScrubRules(scrubbed, state.customScrub));
-    if (event.eventId)
-        state.lastEventId = event.eventId;
-    return event.eventId ?? null;
+    const outgoing = runBeforeSend(applyCustomScrubRules(scrubbed, state.customScrub), state.options.beforeSend);
+    if (!outgoing)
+        return null;
+    state.transport.enqueue(outgoing);
+    if (outgoing.eventId)
+        state.lastEventId = outgoing.eventId;
+    return outgoing.eventId ?? null;
+}
+/** Applies the integrator's `beforeSend`, failing closed: a throw or a
+ * non-object result drops the event. */
+function runBeforeSend(event, hook) {
+    if (typeof hook !== "function")
+        return event;
+    try {
+        const result = hook(event);
+        return result && typeof result === "object" ? result : null;
+    }
+    catch (failure) {
+        if (!beforeSendFailureLogged) {
+            beforeSendFailureLogged = true;
+            safeLog(`beforeSend threw; the event was dropped: ${String(failure)}`);
+        }
+        return null;
+    }
 }
 /** Fetches the project's additional scrub rules by ingest key and merges
  * them over the inline ones. Best-effort, bounded, never throws, never
@@ -295,7 +352,7 @@ async function fetchScrubRules(forState) {
         const url = scrubRulesUrlFor(forState.options.dsn);
         if (!url)
             return;
-        const fetchImpl = forState.options.fetchImpl ?? fetch;
+        const fetchImpl = forState.options.fetchImpl ?? ((...args) => fetch(...args));
         const response = await fetchImpl(url, { method: "GET", signal: AbortSignal.timeout(SCRUB_RULES_TIMEOUT_MS) });
         if (!response.ok)
             return;
@@ -428,6 +485,19 @@ function installUnhandledHandlers() {
     }
     return null;
 }
+/** Logs an init-time refusal through THIS call's own `log` option (falling
+ * back to console.error), not through whatever a previous successful init
+ * left in `state` -- state is intentionally untouched on a refused init, so
+ * using `state?.options.log` here would mean a caller's own logger never
+ * sees why its own call was refused. */
+function logInitFailure(options, message) {
+    try {
+        (options?.log ?? console.error)(`[realuptime-errors] ${message}`);
+    }
+    catch {
+        // Even logging must not throw.
+    }
+}
 /** Initializes the SDK. Safe to call more than once (the last call wins);
  * safe to call with a bad DSN (logs once, stays inert). */
 export function init(options) {
@@ -435,7 +505,14 @@ export function init(options) {
         if (!options?.dsn || typeof options.dsn !== "string") {
             if (!initFailureLogged) {
                 initFailureLogged = true;
-                safeLog("init called without a dsn; error reporting is disabled.");
+                logInitFailure(options, "init called without a dsn; error reporting is disabled.");
+            }
+            return;
+        }
+        if (!isIngestUrl(options.dsn)) {
+            if (!initFailureLogged) {
+                initFailureLogged = true;
+                logInitFailure(options, "dsn must be the full ingest URL, got a bare key (or a malformed URL); expected https://<host>/api/errors/v1/ingest/<key>. Error reporting is disabled.");
             }
             return;
         }

package/dist/scrub.d.ts

@@ -1,6 +1,6 @@
 import type { WireEvent } from "./types.ts";
 /**
- * PII scrub-by-default, client-side (docs/errors-plan.md, "PII
+ * PII scrub-by-default, client-side (the internal-docs repo's errors-plan.md, "PII
  * scrub-by-default, specified"). Runs BEFORE serialization so the sensitive
  * value never transits realuptime's wire; the server runs the same rules
  * again as a second net (packages/db/error-scrub.ts), and the shared
@@ -9,15 +9,32 @@ import type { WireEvent } from "./types.ts";
  *
  * The rules, in the order they run over every scrubbed string:
  *
+ *   0. URL userinfo credentials (`scheme://user:pass@host`, REA-474): the
+ *      userinfo is replaced whole; the host stays readable. Runs first so a
+ *      password that happens to look hex- or base64-shaped is not partially
+ *      eaten by a later rule before the URL rule can see the whole userinfo.
  *   1. JWT three-dot shape (`eyJ...` header, two more base64url segments).
- *   2. Prefixed keys: sk_/pk_/rk_/ghp_/gho_/ghs_/xox?_/rua_/rue_/ru_live_
- *      followed by 8+ token characters.
+ *   2. Prefixed keys: sk_/pk_/rk_/ghp_/gho_/ghs_/xox?_/rua_/rue_/ru_live_/
+ *      whsec_ (REA-474) followed by 8+ token characters.
+ *   2b. AWS access-key ids (REA-474): AKIA/ASIA followed by exactly 16
+ *      uppercase-alnum characters.
  *   3. Card-shaped digit runs: 13-19 digits, optional space/dash
  *      separators, passing Luhn. A digit run that fails Luhn is an order
  *      id, not a card, and stays.
  *   4. Long hex runs (32+).
  *   5. Long base64-ish runs (40+, no slash -- file paths stay readable).
  *
+ * BEFORE any of the above, a KEY-NAME denylist pass (REA-474) runs over
+ * every flat string map (tags, custom context, device, breadcrumb data,
+ * stack-frame locals) and over request headers: a key whose name -- read as
+ * whole snake_case/camelCase segments, so "tokenizer" and "authentic" do
+ * NOT match "token" and "auth" -- is password, passwd, secret, token,
+ * api_key/apikey, auth, authorization, credential(s), private_key,
+ * access_key, or session, has its value replaced whole regardless of shape.
+ * For headers this is folded into the existing REMOVED_HEADERS check (same
+ * allowFields opt-back-in); for the other maps it is unconditional, the
+ * same as the maps' key set itself.
+ *
  * Scrubbed strings: the message, every request header value, the request
  * path and route, every breadcrumb message and breadcrumb data value
  * (Phase 3), any source-context lines a frame carries (a hardcoded secret
@@ -48,6 +65,11 @@ export declare const SCRUBBED = "[scrubbed]";
 /** Identity fields removed whole unless allow-listed by these exact names.
  * `user.id` is deliberately absent: see the module doc. */
 export declare const REMOVED_USER_FIELDS: readonly ["user.email", "user.username"];
+/** True when some contiguous run of a key's segments, joined with no
+ * separator, equals a denylisted word exactly -- catches "api_key",
+ * "apiKey" and "db_password" alike, without matching "tokenizer" or
+ * "authentic". */
+export declare function isKeyDenylisted(key: string): boolean;
 /** Applies the five pattern rules to one string. Pure; exported so the
  * vector tests can drive it directly. */
 export declare function scrubString(value: string): string;

package/dist/scrub.js

@@ -1,5 +1,5 @@
 /**
- * PII scrub-by-default, client-side (docs/errors-plan.md, "PII
+ * PII scrub-by-default, client-side (the internal-docs repo's errors-plan.md, "PII
  * scrub-by-default, specified"). Runs BEFORE serialization so the sensitive
  * value never transits realuptime's wire; the server runs the same rules
  * again as a second net (packages/db/error-scrub.ts), and the shared
@@ -8,15 +8,32 @@
  *
  * The rules, in the order they run over every scrubbed string:
  *
+ *   0. URL userinfo credentials (`scheme://user:pass@host`, REA-474): the
+ *      userinfo is replaced whole; the host stays readable. Runs first so a
+ *      password that happens to look hex- or base64-shaped is not partially
+ *      eaten by a later rule before the URL rule can see the whole userinfo.
  *   1. JWT three-dot shape (`eyJ...` header, two more base64url segments).
- *   2. Prefixed keys: sk_/pk_/rk_/ghp_/gho_/ghs_/xox?_/rua_/rue_/ru_live_
- *      followed by 8+ token characters.
+ *   2. Prefixed keys: sk_/pk_/rk_/ghp_/gho_/ghs_/xox?_/rua_/rue_/ru_live_/
+ *      whsec_ (REA-474) followed by 8+ token characters.
+ *   2b. AWS access-key ids (REA-474): AKIA/ASIA followed by exactly 16
+ *      uppercase-alnum characters.
  *   3. Card-shaped digit runs: 13-19 digits, optional space/dash
  *      separators, passing Luhn. A digit run that fails Luhn is an order
  *      id, not a card, and stays.
  *   4. Long hex runs (32+).
  *   5. Long base64-ish runs (40+, no slash -- file paths stay readable).
  *
+ * BEFORE any of the above, a KEY-NAME denylist pass (REA-474) runs over
+ * every flat string map (tags, custom context, device, breadcrumb data,
+ * stack-frame locals) and over request headers: a key whose name -- read as
+ * whole snake_case/camelCase segments, so "tokenizer" and "authentic" do
+ * NOT match "token" and "auth" -- is password, passwd, secret, token,
+ * api_key/apikey, auth, authorization, credential(s), private_key,
+ * access_key, or session, has its value replaced whole regardless of shape.
+ * For headers this is folded into the existing REMOVED_HEADERS check (same
+ * allowFields opt-back-in); for the other maps it is unconditional, the
+ * same as the maps' key set itself.
+ *
  * Scrubbed strings: the message, every request header value, the request
  * path and route, every breadcrumb message and breadcrumb data value
  * (Phase 3), any source-context lines a frame carries (a hardcoded secret
@@ -49,11 +66,57 @@ const REMOVED_HEADERS = new Set(["authorization", "proxy-authorization", "cookie
 /** Identity fields removed whole unless allow-listed by these exact names.
  * `user.id` is deliberately absent: see the module doc. */
 export const REMOVED_USER_FIELDS = ["user.email", "user.username"];
+const URL_CREDS_RE = /\b([a-zA-Z][a-zA-Z0-9+.-]{0,31}):\/\/[^\s/@:]+:[^\s/@]+@/g;
 const JWT_RE = /\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\b/g;
-const PREFIXED_KEY_RE = /\b(?:sk|pk|rk|ghp|gho|ghs|xox[a-z]|rua|rue|ru_live)_[A-Za-z0-9_-]{8,}/g;
+const PREFIXED_KEY_RE = /\b(?:sk|pk|rk|ghp|gho|ghs|xox[a-z]|rua|rue|ru_live|whsec)_[A-Za-z0-9_-]{8,}/g;
+const AWS_KEY_RE = /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g;
 const CARD_RE = /(?<!\d)(?:\d[ -]?){12,18}\d(?!\d)/g;
 const HEX_RE = /\b[0-9a-fA-F]{32,}\b/g;
 const BASE64_RE = /(?<![A-Za-z0-9+_=-])[A-Za-z0-9+_-]{40,}={0,2}/g;
+/** Key-name denylist (REA-474): normalized (lowercased, separator-joined)
+ * segments that mark a field as sensitive by name alone, regardless of what
+ * its value looks like. Kept as single normalized words/compounds so a
+ * whole-segment match never fires on a substring -- "tokenizer" is one
+ * segment, "tokenizer", not "token" plus a suffix. */
+const KEY_DENYLIST = new Set([
+    "password",
+    "passwd",
+    "secret",
+    "token",
+    "apikey",
+    "auth",
+    "authorization",
+    "credential",
+    "credentials",
+    "privatekey",
+    "accesskey",
+    "session",
+]);
+/** Splits a key into lowercase segments on camelCase boundaries and any
+ * non-alphanumeric separator (snake_case, kebab-case, dotted). */
+function keySegments(key) {
+    return key
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .split(/[^a-zA-Z0-9]+/)
+        .filter(Boolean)
+        .map((s) => s.toLowerCase());
+}
+/** True when some contiguous run of a key's segments, joined with no
+ * separator, equals a denylisted word exactly -- catches "api_key",
+ * "apiKey" and "db_password" alike, without matching "tokenizer" or
+ * "authentic". */
+export function isKeyDenylisted(key) {
+    const segments = keySegments(key);
+    for (let i = 0; i < segments.length; i++) {
+        let joined = "";
+        for (let j = i; j < segments.length; j++) {
+            joined += segments[j];
+            if (KEY_DENYLIST.has(joined))
+                return true;
+        }
+    }
+    return false;
+}
 function luhnValid(digits) {
     let sum = 0;
     let double = false;
@@ -72,8 +135,10 @@ function luhnValid(digits) {
 /** Applies the five pattern rules to one string. Pure; exported so the
  * vector tests can drive it directly. */
 export function scrubString(value) {
-    let out = value.replace(JWT_RE, SCRUBBED);
+    let out = value.replace(URL_CREDS_RE, (_match, scheme) => `${scheme}://${SCRUBBED}@`);
+    out = out.replace(JWT_RE, SCRUBBED);
     out = out.replace(PREFIXED_KEY_RE, SCRUBBED);
+    out = out.replace(AWS_KEY_RE, SCRUBBED);
     out = out.replace(CARD_RE, (run) => {
         const digits = run.replace(/[ -]/g, "");
         return digits.length >= 13 && digits.length <= 19 && luhnValid(digits) ? SCRUBBED : run;
@@ -92,7 +157,7 @@ function scrubRequest(request, allowFields) {
         const headers = {};
         for (const [name, value] of Object.entries(out.headers)) {
             const lower = name.toLowerCase();
-            if (REMOVED_HEADERS.has(lower) && !allowFields.has(lower)) {
+            if ((REMOVED_HEADERS.has(lower) || isKeyDenylisted(lower)) && !allowFields.has(lower)) {
                 headers[name] = SCRUBBED;
             }
             else {
@@ -107,8 +172,9 @@ function scrubBreadcrumb(crumb) {
     let data = null;
     if (crumb.data) {
         data = {};
-        for (const [name, value] of Object.entries(crumb.data))
-            data[name] = scrubString(value);
+        for (const [name, value] of Object.entries(crumb.data)) {
+            data[name] = isKeyDenylisted(name) ? SCRUBBED : scrubString(value);
+        }
     }
     return { ...crumb, message: scrubString(crumb.message), data };
 }
@@ -133,7 +199,12 @@ function scrubUser(user, allowFields) {
 function scrubStringMap(map) {
     const out = {};
     for (const [name, value] of Object.entries(map)) {
-        out[name] = typeof value === "string" ? scrubString(value) : value;
+        if (typeof value !== "string") {
+            out[name] = value;
+        }
+        else {
+            out[name] = isKeyDenylisted(name) ? SCRUBBED : scrubString(value);
+        }
     }
     return out;
 }

package/dist/sourcemaps.d.ts

@@ -9,6 +9,12 @@
  * secret a CI step needs is the DSN the app already has; this module derives
  * the upload URL from that DSN (or from a bare key plus an origin).
  *
+ * Only the main host serves that route. A DSN issued since the hostname split
+ * names the intake host, which takes error events and nothing as heavy as an
+ * upload (up to 10 files of 2 MB each), so a DSN on the intake host uploads to
+ * the main host. The intake answers an upload that still arrives there with a
+ * redirect to the main host (apps/ingest), for clients published before this.
+ *
  * Honesty rules, same as the rest of the SDK:
  *  - Local refusals happen BEFORE any byte is sent (a file over the per-file
  *    cap, more files than a release may hold, no `.map` files found), and
@@ -31,6 +37,10 @@ export declare const MAX_SOURCEMAP_BYTES: number;
 export declare const MAX_ARTIFACTS_PER_RELEASE = 50;
 export declare const MAX_ARTIFACTS_PER_UPLOAD = 10;
 export declare const DEFAULT_API_ORIGIN = "https://realuptime.io";
+/** The intake host every DSN issued since the hostname split names
+ * (`ingestBaseUrl` in packages/db/errors-dsn.ts). Source maps are not
+ * uploaded there; see the module comment. */
+export declare const INGEST_HOSTNAME = "ingest.realuptime.io";
 export declare class SourcemapUploadError extends Error {
     /** Non-2xx answers carry the server's own status and RU- code verbatim. */
     readonly httpStatus?: number;
@@ -41,7 +51,7 @@ export declare class SourcemapUploadError extends Error {
     });
 }
 export interface UploadTarget {
-    /** The project DSN, e.g. `https://realuptime.io/api/errors/v1/ingest/rue_...`. */
+    /** The project DSN, e.g. `https://ingest.realuptime.io/api/errors/v1/ingest/rue_...`. */
     dsn?: string;
     /** A bare ingest key, used with `origin` when no DSN is at hand. */
     ingestKey?: string;
@@ -49,8 +59,12 @@ export interface UploadTarget {
     origin?: string;
 }
 /**
- * `https://host/api/errors/v1/ingest/<key>` -> `https://host/api/errors/v1/sourcemaps/<key>`.
- * A DSN wins over a bare key when both are given; either is enough.
+ * `https://host/api/errors/v1/ingest/<key>` -> `https://host/api/errors/v1/sourcemaps/<key>`,
+ * except that a DSN on the intake host (`ingest.realuptime.io`) uploads to the
+ * main host, `https://realuptime.io`, because only the main host stores maps.
+ * Any other DSN host (a pre-split `realuptime.io` DSN, a self-hosted or local
+ * one) keeps its own origin. A DSN wins over a bare key when both are given;
+ * either is enough.
  */
 export declare function resolveSourcemapUploadUrl(target: UploadTarget): string;
 export interface SourcemapFile {

package/dist/sourcemaps.js

@@ -12,6 +12,12 @@ import { isAbsolute, join, relative, resolve, sep } from "node:path";
  * secret a CI step needs is the DSN the app already has; this module derives
  * the upload URL from that DSN (or from a bare key plus an origin).
  *
+ * Only the main host serves that route. A DSN issued since the hostname split
+ * names the intake host, which takes error events and nothing as heavy as an
+ * upload (up to 10 files of 2 MB each), so a DSN on the intake host uploads to
+ * the main host. The intake answers an upload that still arrives there with a
+ * redirect to the main host (apps/ingest), for clients published before this.
+ *
  * Honesty rules, same as the rest of the SDK:
  *  - Local refusals happen BEFORE any byte is sent (a file over the per-file
  *    cap, more files than a release may hold, no `.map` files found), and
@@ -34,6 +40,10 @@ export const MAX_SOURCEMAP_BYTES = 2 * 1024 * 1024;
 export const MAX_ARTIFACTS_PER_RELEASE = 50;
 export const MAX_ARTIFACTS_PER_UPLOAD = 10;
 export const DEFAULT_API_ORIGIN = "https://realuptime.io";
+/** The intake host every DSN issued since the hostname split names
+ * (`ingestBaseUrl` in packages/db/errors-dsn.ts). Source maps are not
+ * uploaded there; see the module comment. */
+export const INGEST_HOSTNAME = "ingest.realuptime.io";
 const INGEST_KEY_SHAPE = /^rue_[0-9a-f]{32,128}$/;
 export class SourcemapUploadError extends Error {
     /** Non-2xx answers carry the server's own status and RU- code verbatim. */
@@ -47,8 +57,12 @@ export class SourcemapUploadError extends Error {
     }
 }
 /**
- * `https://host/api/errors/v1/ingest/<key>` -> `https://host/api/errors/v1/sourcemaps/<key>`.
- * A DSN wins over a bare key when both are given; either is enough.
+ * `https://host/api/errors/v1/ingest/<key>` -> `https://host/api/errors/v1/sourcemaps/<key>`,
+ * except that a DSN on the intake host (`ingest.realuptime.io`) uploads to the
+ * main host, `https://realuptime.io`, because only the main host stores maps.
+ * Any other DSN host (a pre-split `realuptime.io` DSN, a self-hosted or local
+ * one) keeps its own origin. A DSN wins over a bare key when both are given;
+ * either is enough.
  */
 export function resolveSourcemapUploadUrl(target) {
     if (target.dsn) {
@@ -63,7 +77,8 @@ export function resolveSourcemapUploadUrl(target) {
         if (!match) {
             throw new SourcemapUploadError("The DSN does not look like a realuptime errors DSN (expected .../api/errors/v1/ingest/rue_...).");
         }
-        return `${url.origin}${match[1]}/sourcemaps/${match[2]}`;
+        const origin = url.hostname === INGEST_HOSTNAME ? DEFAULT_API_ORIGIN : url.origin;
+        return `${origin}${match[1]}/sourcemaps/${match[2]}`;
     }
     if (target.ingestKey) {
         if (!INGEST_KEY_SHAPE.test(target.ingestKey)) {

package/dist/types.d.ts

@@ -1,5 +1,5 @@
 /**
- * The Errors wire contract (docs/errors-plan.md, "The SDKs: two
+ * The Errors wire contract (the internal-docs repo's errors-plan.md, "The SDKs: two
  * languages, one contract").
  *
  * DUPLICATED, not imported. Same convention as apps/agent/types.ts and for
@@ -170,7 +170,16 @@ export interface WireEvent {
      * user's report to this exact occurrence. An integration that never
      * enables feedback keeps emitting the id-less payload it always did. */
     eventId?: string;
+    /** REA-569: severity, Sentry's five-value convention. Per-capture only
+     * (CaptureContext.level, not a sticky init()/scope option): unlike
+     * environment or release, a severity is a fact about THIS occurrence, not
+     * about the process. Absent resolves to "error" server-side. */
+    level?: ErrorLevel;
 }
+/** REA-569: the closed severity set, Sentry's own five values so a
+ * migrating customer's rule filters translate directly. */
+export type ErrorLevel = "fatal" | "error" | "warning" | "info" | "debug";
+export declare const ERROR_LEVELS: readonly ErrorLevel[];
 export interface WireBatch {
     /** e.g. "realuptime-errors-js/0.1.0" */
     sdk: string;
@@ -240,7 +249,7 @@ export interface WireFeedback {
      * filled it. Scrubbed by the same pattern rules. */
     name?: string;
     email?: string;
-    /** e.g. "realuptime-errors-js/0.4.0" */
+    /** e.g. "realuptime-errors-js/0.5.0" */
     sdk: string;
 }
 export declare const MAX_FEEDBACK_COMMENTS_LENGTH = 4000;

package/dist/types.js

@@ -1,5 +1,5 @@
 /**
- * The Errors wire contract (docs/errors-plan.md, "The SDKs: two
+ * The Errors wire contract (the internal-docs repo's errors-plan.md, "The SDKs: two
  * languages, one contract").
  *
  * DUPLICATED, not imported. Same convention as apps/agent/types.ts and for
@@ -31,6 +31,7 @@
  * (a removed field, a changed meaning) gets a versioned PATH, the way the
  * fingerprint algorithm gets a version rather than mutating history.
  */
+export const ERROR_LEVELS = ["fatal", "error", "warning", "info", "debug"];
 // Mirrored by MAX_ERROR_EVENTS_PER_BATCH etc. in packages/db/error-ingest.ts
 // and pinned by wire-contract.test.ts on both sides.
 export const MAX_EVENTS_PER_BATCH = 50;

package/index.ts

@@ -14,6 +14,7 @@ import {
 } from "./feedback.ts";
 import { scrubEvent } from "./scrub.ts";
 export type { FeedbackOptions, ReportDialogField, ReportDialogHandle, ReportDialogOptions, ReportDialogTheme } from "./feedback.ts";
+export type { WireEvent } from "./types.ts";
 import {
   applyCustomScrubRules,
   type CompiledCustomScrubRules,
@@ -31,6 +32,7 @@ import {
   MAX_MESSAGE_LENGTH,
   MAX_STRING_LENGTH,
   MAX_TAGS_PER_EVENT,
+  type ErrorLevel,
   type WireBreadcrumb,
   type WireDevice,
   type WireEvent,
@@ -41,7 +43,7 @@ import {
 
 /**
  * @realuptime/errors: minimal JS/Node error tracking SDK, Phase 1
- * (docs/errors-plan.md). Captures unhandled exceptions and rejections plus
+ * (the internal-docs repo's errors-plan.md). Captures unhandled exceptions and rejections plus
  * manual `captureException`/`captureMessage`, scrubs PII client-side by
  * default (scrub.ts), and posts to the project's DSN-style ingest endpoint.
  *
@@ -52,14 +54,14 @@ import {
  */
 
 export const SDK_NAME = "realuptime-errors-js";
-export const SDK_VERSION = "0.4.0";
+export const SDK_VERSION = "0.5.0";
 /** How long the one-time rules fetch may take before the SDK stops waiting
  * for it (it was never blocking capture anyway). */
 export const SCRUB_RULES_TIMEOUT_MS = 5_000;
 
 export interface ErrorsInit {
   /** The project's ingest URL, e.g.
-   * `https://realuptime.io/api/errors/v1/ingest/rue_...`. Shown once at
+   * `https://ingest.realuptime.io/api/errors/v1/ingest/rue_...`. Shown once at
    * project creation; safe to embed client-side (it can only submit events
    * to its one project). */
   dsn: string;
@@ -98,6 +100,14 @@ export interface ErrorsInit {
    * switch in realuptime Errors settings must ALSO be on, or the endpoint
    * refuses with `reason: "feedback_disabled"`. See feedback.ts. */
   feedback?: FeedbackOptions;
+  /** A last look at every event before it is queued: return the event to
+   * send (the same object or a new one), or null to drop it. Runs AFTER the
+   * default scrub and any additional scrub rules, so it sees exactly what
+   * would otherwise leave and can only narrow it further. Fails closed: a
+   * hook that throws drops the event (logged once) rather than letting it
+   * through unfiltered, because a hook installed to remove data must never
+   * turn into the reason that data leaves. */
+  beforeSend?: (event: WireEvent) => WireEvent | null;
   /** Test seams. */
   fetchImpl?: typeof fetch;
   now?: () => number;
@@ -131,6 +141,7 @@ interface SdkState {
 
 let state: SdkState | null = null;
 let initFailureLogged = false;
+let beforeSendFailureLogged = false;
 
 function safeLog(message: string): void {
   try {
@@ -140,6 +151,42 @@ function safeLog(message: string): void {
   }
 }
 
+/** The ingest route's path shape: `/api/errors/v1/ingest/<key>`, an
+ * optional trailing slash, nothing else. Mirrors the marker check in
+ * feedback.ts/custom-scrub.ts and the stricter parse in sourcemaps.ts. */
+const INGEST_PATH_RE = /^\/api\/errors\/v1\/ingest\/[^/?#]+\/?$/;
+
+/**
+ * REA-575: a `dsn` must be the full ingest URL the server hands out at
+ * project creation, not the bare `rue_...` key alone. Before this check,
+ * `init()` accepted any non-empty string and handed it straight to the
+ * transport as the fetch endpoint: a bare key is not a fetchable URL, so
+ * every send failed inside the transport's own never-throw try/catch and
+ * the SDK silently reported nothing, forever, with no signal anywhere
+ * (realuptime-web's own DSN held exactly this mistake in production).
+ */
+function isIngestUrl(dsn: string): boolean {
+  let url: URL;
+  try {
+    url = new URL(dsn);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+  return INGEST_PATH_RE.test(url.pathname);
+}
+
+/**
+ * Whether error reporting is actually on: `init()` was called with a dsn
+ * that passed `isIngestUrl`. A host process should log this once at
+ * startup (`realuptimeErrors.isEnabled()`) rather than assume that wiring
+ * `init()` into the code means events are flowing -- REA-575 was exactly
+ * that assumption, wrong for months because nothing checked it.
+ */
+export function isEnabled(): boolean {
+  return state !== null;
+}
+
 function clip(value: string, max: number): string {
   return value.length > max ? value.slice(0, max) : value;
 }
@@ -186,6 +233,9 @@ export interface CaptureContext {
   tags?: Record<string, string>;
   /** v2: custom context for THIS event only, merged over the sticky scope. */
   context?: Record<string, string>;
+  /** REA-569: severity for THIS event only. No sticky/init() equivalent --
+   * see WireEvent.level's doc for why. */
+  level?: ErrorLevel;
 }
 
 /** Bounds one caller-supplied string map: keys and values clipped, entries
@@ -345,6 +395,7 @@ function buildEvent(message: string, exceptionType: string | null, stack: string
     // REA-257: minted only when feedback is enabled, so an integration that
     // never opted in keeps emitting the id-less payload it always did.
     ...(state?.feedback ? { eventId: mintEventId() } : {}),
+    ...(context.level ? { level: context.level } : {}),
   };
 }
 
@@ -391,9 +442,27 @@ function capture(event: WireEvent): string | null {
   if (!state) return null;
   // Defaults first, always; the customer's additional rules on the result.
   const scrubbed = scrubEvent(event, state.options.allowFields ?? []);
-  state.transport.enqueue(applyCustomScrubRules(scrubbed, state.customScrub));
-  if (event.eventId) state.lastEventId = event.eventId;
-  return event.eventId ?? null;
+  const outgoing = runBeforeSend(applyCustomScrubRules(scrubbed, state.customScrub), state.options.beforeSend);
+  if (!outgoing) return null;
+  state.transport.enqueue(outgoing);
+  if (outgoing.eventId) state.lastEventId = outgoing.eventId;
+  return outgoing.eventId ?? null;
+}
+
+/** Applies the integrator's `beforeSend`, failing closed: a throw or a
+ * non-object result drops the event. */
+function runBeforeSend(event: WireEvent, hook: ErrorsInit["beforeSend"]): WireEvent | null {
+  if (typeof hook !== "function") return event;
+  try {
+    const result = hook(event);
+    return result && typeof result === "object" ? result : null;
+  } catch (failure) {
+    if (!beforeSendFailureLogged) {
+      beforeSendFailureLogged = true;
+      safeLog(`beforeSend threw; the event was dropped: ${String(failure)}`);
+    }
+    return null;
+  }
 }
 
 /** Fetches the project's additional scrub rules by ingest key and merges
@@ -404,7 +473,7 @@ async function fetchScrubRules(forState: SdkState): Promise<void> {
   try {
     const url = scrubRulesUrlFor(forState.options.dsn);
     if (!url) return;
-    const fetchImpl = forState.options.fetchImpl ?? fetch;
+    const fetchImpl = forState.options.fetchImpl ?? ((...args: Parameters<typeof fetch>) => fetch(...args));
     const response = await fetchImpl(url, { method: "GET", signal: AbortSignal.timeout(SCRUB_RULES_TIMEOUT_MS) });
     if (!response.ok) return;
     const body = (await response.json()) as { rules?: unknown };
@@ -533,6 +602,19 @@ function installUnhandledHandlers(): (() => void) | null {
   return null;
 }
 
+/** Logs an init-time refusal through THIS call's own `log` option (falling
+ * back to console.error), not through whatever a previous successful init
+ * left in `state` -- state is intentionally untouched on a refused init, so
+ * using `state?.options.log` here would mean a caller's own logger never
+ * sees why its own call was refused. */
+function logInitFailure(options: ErrorsInit | undefined, message: string): void {
+  try {
+    (options?.log ?? console.error)(`[realuptime-errors] ${message}`);
+  } catch {
+    // Even logging must not throw.
+  }
+}
+
 /** Initializes the SDK. Safe to call more than once (the last call wins);
  * safe to call with a bad DSN (logs once, stays inert). */
 export function init(options: ErrorsInit): void {
@@ -540,7 +622,17 @@ export function init(options: ErrorsInit): void {
     if (!options?.dsn || typeof options.dsn !== "string") {
       if (!initFailureLogged) {
         initFailureLogged = true;
-        safeLog("init called without a dsn; error reporting is disabled.");
+        logInitFailure(options, "init called without a dsn; error reporting is disabled.");
+      }
+      return;
+    }
+    if (!isIngestUrl(options.dsn)) {
+      if (!initFailureLogged) {
+        initFailureLogged = true;
+        logInitFailure(
+          options,
+          "dsn must be the full ingest URL, got a bare key (or a malformed URL); expected https://<host>/api/errors/v1/ingest/<key>. Error reporting is disabled.",
+        );
       }
       return;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@realuptime/errors",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Zero-dependency error tracking SDK for JavaScript and Node (RealUptime Errors).",
   "type": "module",
   "main": "./dist/index.js",
@@ -54,9 +54,9 @@
     "test": "vitest run"
   },
   "devDependencies": {
-    "@types/node": "^22.20.0",
-    "jsdom": "30.0.1",
+    "@types/node": "^24.19.2",
+    "jsdom": "30.1.3",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^5.0.5"
   }
 }

package/scrub.ts

@@ -1,7 +1,7 @@
 import type { WireBreadcrumb, WireDevice, WireEvent, WireRequest, WireUser } from "./types.ts";
 
 /**
- * PII scrub-by-default, client-side (docs/errors-plan.md, "PII
+ * PII scrub-by-default, client-side (the internal-docs repo's errors-plan.md, "PII
  * scrub-by-default, specified"). Runs BEFORE serialization so the sensitive
  * value never transits realuptime's wire; the server runs the same rules
  * again as a second net (packages/db/error-scrub.ts), and the shared
@@ -10,15 +10,32 @@ import type { WireBreadcrumb, WireDevice, WireEvent, WireRequest, WireUser } fro
  *
  * The rules, in the order they run over every scrubbed string:
  *
+ *   0. URL userinfo credentials (`scheme://user:pass@host`, REA-474): the
+ *      userinfo is replaced whole; the host stays readable. Runs first so a
+ *      password that happens to look hex- or base64-shaped is not partially
+ *      eaten by a later rule before the URL rule can see the whole userinfo.
  *   1. JWT three-dot shape (`eyJ...` header, two more base64url segments).
- *   2. Prefixed keys: sk_/pk_/rk_/ghp_/gho_/ghs_/xox?_/rua_/rue_/ru_live_
- *      followed by 8+ token characters.
+ *   2. Prefixed keys: sk_/pk_/rk_/ghp_/gho_/ghs_/xox?_/rua_/rue_/ru_live_/
+ *      whsec_ (REA-474) followed by 8+ token characters.
+ *   2b. AWS access-key ids (REA-474): AKIA/ASIA followed by exactly 16
+ *      uppercase-alnum characters.
  *   3. Card-shaped digit runs: 13-19 digits, optional space/dash
  *      separators, passing Luhn. A digit run that fails Luhn is an order
  *      id, not a card, and stays.
  *   4. Long hex runs (32+).
  *   5. Long base64-ish runs (40+, no slash -- file paths stay readable).
  *
+ * BEFORE any of the above, a KEY-NAME denylist pass (REA-474) runs over
+ * every flat string map (tags, custom context, device, breadcrumb data,
+ * stack-frame locals) and over request headers: a key whose name -- read as
+ * whole snake_case/camelCase segments, so "tokenizer" and "authentic" do
+ * NOT match "token" and "auth" -- is password, passwd, secret, token,
+ * api_key/apikey, auth, authorization, credential(s), private_key,
+ * access_key, or session, has its value replaced whole regardless of shape.
+ * For headers this is folded into the existing REMOVED_HEADERS check (same
+ * allowFields opt-back-in); for the other maps it is unconditional, the
+ * same as the maps' key set itself.
+ *
  * Scrubbed strings: the message, every request header value, the request
  * path and route, every breadcrumb message and breadcrumb data value
  * (Phase 3), any source-context lines a frame carries (a hardcoded secret
@@ -55,12 +72,60 @@ const REMOVED_HEADERS = new Set(["authorization", "proxy-authorization", "cookie
  * `user.id` is deliberately absent: see the module doc. */
 export const REMOVED_USER_FIELDS = ["user.email", "user.username"] as const;
 
+const URL_CREDS_RE = /\b([a-zA-Z][a-zA-Z0-9+.-]{0,31}):\/\/[^\s/@:]+:[^\s/@]+@/g;
 const JWT_RE = /\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\b/g;
-const PREFIXED_KEY_RE = /\b(?:sk|pk|rk|ghp|gho|ghs|xox[a-z]|rua|rue|ru_live)_[A-Za-z0-9_-]{8,}/g;
+const PREFIXED_KEY_RE = /\b(?:sk|pk|rk|ghp|gho|ghs|xox[a-z]|rua|rue|ru_live|whsec)_[A-Za-z0-9_-]{8,}/g;
+const AWS_KEY_RE = /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g;
 const CARD_RE = /(?<!\d)(?:\d[ -]?){12,18}\d(?!\d)/g;
 const HEX_RE = /\b[0-9a-fA-F]{32,}\b/g;
 const BASE64_RE = /(?<![A-Za-z0-9+_=-])[A-Za-z0-9+_-]{40,}={0,2}/g;
 
+/** Key-name denylist (REA-474): normalized (lowercased, separator-joined)
+ * segments that mark a field as sensitive by name alone, regardless of what
+ * its value looks like. Kept as single normalized words/compounds so a
+ * whole-segment match never fires on a substring -- "tokenizer" is one
+ * segment, "tokenizer", not "token" plus a suffix. */
+const KEY_DENYLIST = new Set([
+  "password",
+  "passwd",
+  "secret",
+  "token",
+  "apikey",
+  "auth",
+  "authorization",
+  "credential",
+  "credentials",
+  "privatekey",
+  "accesskey",
+  "session",
+]);
+
+/** Splits a key into lowercase segments on camelCase boundaries and any
+ * non-alphanumeric separator (snake_case, kebab-case, dotted). */
+function keySegments(key: string): string[] {
+  return key
+    .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+    .split(/[^a-zA-Z0-9]+/)
+    .filter(Boolean)
+    .map((s) => s.toLowerCase());
+}
+
+/** True when some contiguous run of a key's segments, joined with no
+ * separator, equals a denylisted word exactly -- catches "api_key",
+ * "apiKey" and "db_password" alike, without matching "tokenizer" or
+ * "authentic". */
+export function isKeyDenylisted(key: string): boolean {
+  const segments = keySegments(key);
+  for (let i = 0; i < segments.length; i++) {
+    let joined = "";
+    for (let j = i; j < segments.length; j++) {
+      joined += segments[j];
+      if (KEY_DENYLIST.has(joined)) return true;
+    }
+  }
+  return false;
+}
+
 function luhnValid(digits: string): boolean {
   let sum = 0;
   let double = false;
@@ -79,8 +144,10 @@ function luhnValid(digits: string): boolean {
 /** Applies the five pattern rules to one string. Pure; exported so the
  * vector tests can drive it directly. */
 export function scrubString(value: string): string {
-  let out = value.replace(JWT_RE, SCRUBBED);
+  let out = value.replace(URL_CREDS_RE, (_match, scheme: string) => `${scheme}://${SCRUBBED}@`);
+  out = out.replace(JWT_RE, SCRUBBED);
   out = out.replace(PREFIXED_KEY_RE, SCRUBBED);
+  out = out.replace(AWS_KEY_RE, SCRUBBED);
   out = out.replace(CARD_RE, (run) => {
     const digits = run.replace(/[ -]/g, "");
     return digits.length >= 13 && digits.length <= 19 && luhnValid(digits) ? SCRUBBED : run;
@@ -98,7 +165,7 @@ function scrubRequest(request: WireRequest, allowFields: ReadonlySet<string>): W
     const headers: Record<string, string> = {};
     for (const [name, value] of Object.entries(out.headers)) {
       const lower = name.toLowerCase();
-      if (REMOVED_HEADERS.has(lower) && !allowFields.has(lower)) {
+      if ((REMOVED_HEADERS.has(lower) || isKeyDenylisted(lower)) && !allowFields.has(lower)) {
         headers[name] = SCRUBBED;
       } else {
         headers[name] = scrubString(value);
@@ -113,7 +180,9 @@ function scrubBreadcrumb(crumb: WireBreadcrumb): WireBreadcrumb {
   let data: Record<string, string> | null = null;
   if (crumb.data) {
     data = {};
-    for (const [name, value] of Object.entries(crumb.data)) data[name] = scrubString(value);
+    for (const [name, value] of Object.entries(crumb.data)) {
+      data[name] = isKeyDenylisted(name) ? SCRUBBED : scrubString(value);
+    }
   }
   return { ...crumb, message: scrubString(crumb.message), data };
 }
@@ -138,7 +207,11 @@ function scrubUser(user: WireUser, allowFields: ReadonlySet<string>): WireUser {
 function scrubStringMap(map: Record<string, string>): Record<string, string> {
   const out: Record<string, string> = {};
   for (const [name, value] of Object.entries(map)) {
-    out[name] = typeof value === "string" ? scrubString(value) : value;
+    if (typeof value !== "string") {
+      out[name] = value;
+    } else {
+      out[name] = isKeyDenylisted(name) ? SCRUBBED : scrubString(value);
+    }
   }
   return out;
 }

package/sourcemaps.ts

@@ -13,6 +13,12 @@ import { isAbsolute, join, relative, resolve, sep } from "node:path";
  * secret a CI step needs is the DSN the app already has; this module derives
  * the upload URL from that DSN (or from a bare key plus an origin).
  *
+ * Only the main host serves that route. A DSN issued since the hostname split
+ * names the intake host, which takes error events and nothing as heavy as an
+ * upload (up to 10 files of 2 MB each), so a DSN on the intake host uploads to
+ * the main host. The intake answers an upload that still arrives there with a
+ * redirect to the main host (apps/ingest), for clients published before this.
+ *
  * Honesty rules, same as the rest of the SDK:
  *  - Local refusals happen BEFORE any byte is sent (a file over the per-file
  *    cap, more files than a release may hold, no `.map` files found), and
@@ -38,6 +44,11 @@ export const MAX_ARTIFACTS_PER_UPLOAD = 10;
 
 export const DEFAULT_API_ORIGIN = "https://realuptime.io";
 
+/** The intake host every DSN issued since the hostname split names
+ * (`ingestBaseUrl` in packages/db/errors-dsn.ts). Source maps are not
+ * uploaded there; see the module comment. */
+export const INGEST_HOSTNAME = "ingest.realuptime.io";
+
 const INGEST_KEY_SHAPE = /^rue_[0-9a-f]{32,128}$/;
 
 export class SourcemapUploadError extends Error {
@@ -53,7 +64,7 @@ export class SourcemapUploadError extends Error {
 }
 
 export interface UploadTarget {
-  /** The project DSN, e.g. `https://realuptime.io/api/errors/v1/ingest/rue_...`. */
+  /** The project DSN, e.g. `https://ingest.realuptime.io/api/errors/v1/ingest/rue_...`. */
   dsn?: string;
   /** A bare ingest key, used with `origin` when no DSN is at hand. */
   ingestKey?: string;
@@ -62,8 +73,12 @@ export interface UploadTarget {
 }
 
 /**
- * `https://host/api/errors/v1/ingest/<key>` -> `https://host/api/errors/v1/sourcemaps/<key>`.
- * A DSN wins over a bare key when both are given; either is enough.
+ * `https://host/api/errors/v1/ingest/<key>` -> `https://host/api/errors/v1/sourcemaps/<key>`,
+ * except that a DSN on the intake host (`ingest.realuptime.io`) uploads to the
+ * main host, `https://realuptime.io`, because only the main host stores maps.
+ * Any other DSN host (a pre-split `realuptime.io` DSN, a self-hosted or local
+ * one) keeps its own origin. A DSN wins over a bare key when both are given;
+ * either is enough.
  */
 export function resolveSourcemapUploadUrl(target: UploadTarget): string {
   if (target.dsn) {
@@ -77,7 +92,8 @@ export function resolveSourcemapUploadUrl(target: UploadTarget): string {
     if (!match) {
       throw new SourcemapUploadError("The DSN does not look like a realuptime errors DSN (expected .../api/errors/v1/ingest/rue_...).");
     }
-    return `${url.origin}${match[1]}/sourcemaps/${match[2]}`;
+    const origin = url.hostname === INGEST_HOSTNAME ? DEFAULT_API_ORIGIN : url.origin;
+    return `${origin}${match[1]}/sourcemaps/${match[2]}`;
   }
   if (target.ingestKey) {
     if (!INGEST_KEY_SHAPE.test(target.ingestKey)) {

package/types.ts

@@ -1,5 +1,5 @@
 /**
- * The Errors wire contract (docs/errors-plan.md, "The SDKs: two
+ * The Errors wire contract (the internal-docs repo's errors-plan.md, "The SDKs: two
  * languages, one contract").
  *
  * DUPLICATED, not imported. Same convention as apps/agent/types.ts and for
@@ -179,8 +179,18 @@ export interface WireEvent {
    * user's report to this exact occurrence. An integration that never
    * enables feedback keeps emitting the id-less payload it always did. */
   eventId?: string;
+  /** REA-569: severity, Sentry's five-value convention. Per-capture only
+   * (CaptureContext.level, not a sticky init()/scope option): unlike
+   * environment or release, a severity is a fact about THIS occurrence, not
+   * about the process. Absent resolves to "error" server-side. */
+  level?: ErrorLevel;
 }
 
+/** REA-569: the closed severity set, Sentry's own five values so a
+ * migrating customer's rule filters translate directly. */
+export type ErrorLevel = "fatal" | "error" | "warning" | "info" | "debug";
+export const ERROR_LEVELS: readonly ErrorLevel[] = ["fatal", "error", "warning", "info", "debug"];
+
 export interface WireBatch {
   /** e.g. "realuptime-errors-js/0.1.0" */
   sdk: string;
@@ -282,7 +292,7 @@ export interface WireFeedback {
    * filled it. Scrubbed by the same pattern rules. */
   name?: string;
   email?: string;
-  /** e.g. "realuptime-errors-js/0.4.0" */
+  /** e.g. "realuptime-errors-js/0.5.0" */
   sdk: string;
 }