@redact-secret/adapter-otel-trace 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -25,6 +25,22 @@ version numbers start again here, at `0.1.0`, and do not follow the old name's.
 
 ## [Unreleased]
 
+## [0.1.2] - 2026-10-02
+
+### Added
+
+- **One aggregate budget per span** (redact-secret/redact-secret-adapters#173), shared by the span name, every attribute, event and link and the status message. `operationLimits` overrides it (defaults as in `@redact-secret/adapter`); `redactAttributesWith` takes it for its one bag. A span ended re-entrantly inside the next processor has its own budget.
+
+- **Verified core scan options** (redact-secret/redact-secret-adapters#175): `createRedactingSpanProcessor`, `RedactingSpanProcessorWith` and `redactAttributesWith` take `scanLimits`, `ruleset` and `placeholderFormatter` (and still `policy`), validated and snapshotted once. The live factory rejects an unsupported core, or a ruleset or limits the core refuses, with a fixed `CoreOptionsError`. Available from the declared core floor, verified at both endpoints by `test/scan-options-live.test.ts`. Omit them and nothing changes.
+
+### Changed
+
+- **Key-aware detection** (redact-secret/redact-secret-adapters#172). A string attribute value on a span, event or link is now scanned with its attribute name as detection context, through the shared primitive in `@redact-secret/adapter`, so a context-dependent credential (`api_key`, `password`) is masked. The attribute name is never rewritten or output; string-array elements, the span name, event names and the status message have no direct key and are scanned as before. Cost: a string attribute is scanned twice unless its own scan already redacted or blocked it.
+
+- **Behavior change with defaults:** a span that inspects more than the default budget now has every string not yet inspected replaced by `[REDACTED:LIMIT_EXCEEDED]` (counted as `limited`), and is still forwarded. Before, a span's only bound was `maxStringLength` per string.
+
+- **Dependency range raised: `@redact-secret/adapter` `^0.1.3` -> `^0.1.7`** (redact-secret/redact-secret-adapters#172, #173, #175). This release needs the key-context primitive, the operation budget and the scan options that `@redact-secret/adapter` 0.1.7 introduces, which no earlier published version has; against `0.1.3` the package fails to import. Backed by the `published-combination` CI job (`scripts/check-published-combination.mjs`), which installs this package with the lowest published sibling its range admits (and this checkout's tarball for a sibling not yet published). No `@redact-secret/core` range change.
+
 ## [0.1.1] - 2026-10-01
 ### Changed
 

package/README.md

@@ -1,7 +1,30 @@
 # @redact-secret/adapter-otel-trace
 
-A redacting OpenTelemetry JS `SpanProcessor` for **traces**, over the
-[Redact Secret](https://github.com/redact-secret/redact-secret) core.
+[![npm version](https://img.shields.io/npm/v/@redact-secret/adapter-otel-trace)](https://www.npmjs.com/package/@redact-secret/adapter-otel-trace)
+[![npm downloads](https://img.shields.io/npm/dm/@redact-secret/adapter-otel-trace)](https://www.npmjs.com/package/@redact-secret/adapter-otel-trace)
+[![OpenTelemetry SDK peer range](https://img.shields.io/npm/dependency-version/@redact-secret/adapter-otel-trace/peer/@opentelemetry/sdk-trace-base)](https://www.npmjs.com/package/@redact-secret/adapter-otel-trace?activeTab=dependencies)
+[![Node.js](https://img.shields.io/node/v/@redact-secret/adapter-otel-trace)](https://www.npmjs.com/package/@redact-secret/adapter-otel-trace)
+[![types included](https://img.shields.io/npm/types/@redact-secret/adapter-otel-trace)](https://www.npmjs.com/package/@redact-secret/adapter-otel-trace)
+[![CI](https://github.com/redact-secret/redact-secret-adapters/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/redact-secret/redact-secret-adapters/actions/workflows/ci.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/redact-secret/redact-secret-adapters/badge)](https://scorecard.dev/viewer/?uri=github.com/redact-secret/redact-secret-adapters)
+[![License: MIT](https://img.shields.io/npm/l/@redact-secret/adapter-otel-trace)](https://github.com/redact-secret/redact-secret-adapters/blob/main/LICENSE)
+
+Keep secrets out of OpenTelemetry **traces**. Wrap the span processor you
+already have, and span names, attributes, events and links are redacted before
+they reach your exporter.
+
+Built on the [Redact Secret](https://github.com/redact-secret/redact-secret)
+core, which does the detection.
+
+## Install
+
+```bash
+npm install @redact-secret/core @redact-secret/adapter-otel-trace @opentelemetry/sdk-trace-base
+```
+
+Needs Node.js 20, 22 or 24 and `@opentelemetry/sdk-trace-base ^2.0.0`. ESM only.
+
+## Quick start
 
 ```js
 import { NodeTracerProvider, BatchSpanProcessor } from "@opentelemetry/sdk-trace-node";
@@ -12,21 +35,7 @@ const provider = new NodeTracerProvider({
 });
 ```
 
-## What it covers, and what it does not
-
-**Spans only.** This package plugs into the tracing pipeline and sees what a
-`SpanProcessor` sees. It does **not** protect OpenTelemetry **Logs**: a
-`LogRecord` emitted through `@opentelemetry/sdk-logs` (or a log bridge such as
-the pino or winston instrumentation) never passes through it and reaches its
-exporter as it was written. There is no OpenTelemetry Logs adapter yet;
-`@redact-secret/adapter-otel-logs` is a reserved name for one, not a package.
-Metrics are not covered either.
-
-This package was published as
-[`@redact-secret/adapter-otel`](https://www.npmjs.com/package/@redact-secret/adapter-otel) up to `0.1.2`. That name keeps working — its
-releases after `0.1.2` re-export this package — but new code should import
-from here; see
-[Migrating from `@redact-secret/adapter-otel`](#migrating-from-redact-secretadapter-otel).
+A complete, runnable example:
 
 <!-- smoke-test:example -->
 ```js
@@ -57,95 +66,112 @@ await provider.shutdown();
 // ...{"name":"deploy <SECRET_1>",...,"attributes":[{"key":"llm.input_messages","value":{"stringValue":"deploy with token <SECRET_1>"}}],...
 ```
 
-The clean-install smoke test (`npm run smoke-test`) runs this block verbatim
-from a throwaway project outside the repository, against the real core, and
-inspects the exporter's bytes.
+CI runs this block verbatim from a clean install outside the repository
+(`npm run smoke-test`), against the real core, and inspects the exporter's
+bytes.
 
-## What is redacted
+To check that your own provider and exporter are covered, run the
+[placement recipe](https://github.com/redact-secret/redact-secret-adapters/tree/main/examples/placement-js):
+it serializes a span with a synthetic token the way an exporter would and
+includes a processor registered ahead of the redacting one as a negative control.
 
-In `onEnd`, before the span reaches the next processor, the processor redacts
-the span name, every string and string-array attribute (a `null` hole in an
-array is kept in place), every event's name and attributes, the status message,
-and every link's attributes. Attribute names are not
-allowlisted, so OpenInference (`llm.input_messages`, `input.value`, …) and GenAI
-semantic-convention attributes (`gen_ai.prompt`, …) are covered without
-hardcoding either convention.
+## What is covered
 
-## The load-bearing assumption
+| Covered | Not covered |
+| --- | --- |
+| The span name | OpenTelemetry **Logs** (`LogRecord`s from `@opentelemetry/sdk-logs` or a log bridge) |
+| Every string and string-array attribute (a `null` hole in an array stays in place) | Metrics |
+| Every event's name and attributes | Attribute **names**, which are never scanned on their own or rewritten (a name is only context for the string value under it). Do not put a secret in an attribute key |
+| The status message | Spans the wrapped processor never receives: sampled out, or handled by a processor registered ahead of this one |
+| Every link's attributes | |
 
-`ReadableSpan`'s fields are typed `readonly` but are plain writable objects at
-runtime, and this processor writes the masked values back in place. Every write
-is read back; if one does not take (for example, an earlier processor froze the
-attributes), the span is **dropped** — not exported, and nothing is thrown out
-of `span.end()` — and a one-time process warning
-(`REDACT_SECRET_SPAN_DROPPED`) names the field, never its value.
-`test/otel-host.test.ts` builds a real span, passes it through a real
-`BasicTracerProvider`, and asserts the exporter saw redacted fields. That
-assertion is not optional.
+Attribute names are not allowlisted, so OpenInference (`llm.input_messages`,
+`input.value`, …) and GenAI semantic-convention attributes (`gen_ai.prompt`,
+…) are covered without hardcoding either convention.
 
-## Exports
+**This is a trace processor only.** A `LogRecord` never passes through it and
+reaches its exporter as it was written. For logs use
+[`@redact-secret/adapter-otel-logs`](https://github.com/redact-secret/redact-secret-adapters/tree/main/packages/adapter-otel-logs),
+a separate package currently published as a beta (`0.1.0-beta.2`, dist-tag `beta`).
 
-| Export | Purpose |
-| --- | --- |
-| `createRedactingSpanProcessor(next, options?)` | Live: awaits the core's `initialize()`, wraps `next` |
-| `RedactingSpanProcessorWith` | `new (next, scanAndRedact, options?)` — injected scanner |
-| `redactAttributesWith(scanAndRedact, attributes, options?)` | Mutates one attribute bag in place; throws a `TypeError` (naming no value) if it cannot |
+When a value cannot be scanned, a fixed marker replaces it. See
+[`@redact-secret/adapter`](https://github.com/redact-secret/redact-secret-adapters/tree/main/packages/adapter#fail-closed-markers)
+for the markers.
 
-`options` is `{ policy, maxStringLength }` — `MaskLeafOptions`, re-exported
-here — plus `onOutcome` and, on the live factory, `pii` — every option
-`adapter-otel` `0.1.2` had. The older `RedactAttributesOptions` alias is deprecated. See
-[`@redact-secret/adapter`](../adapter#fail-closed-markers) for the markers.
+### A span that cannot be redacted is dropped
 
-**Attribute names are not scanned.** The processor masks attribute *values*
-(and the span name, event names, and status message). Every attribute key,
-on the span, its events, and its links, reaches the exporter unchanged, so an
-attribute *named* after a secret keeps that name. Do not put a secret in an
-attribute key.
+(Other markers and limits, and what to do about each:
+[troubleshooting](https://github.com/redact-secret/redact-secret-adapters/blob/main/docs/troubleshooting.md#logs-and-spans-markers).)
 
-## PII detection is opt-in
+`ReadableSpan`'s fields are typed `readonly` but are plain writable objects at
+runtime, and this processor writes the masked values back in place. Every
+write is read back. If one does not take (for example, an earlier processor
+froze the attributes), the span is **dropped**: not exported, and nothing is
+thrown out of `span.end()`. A one-time process warning
+(`REDACT_SECRET_SPAN_DROPPED`) names the field, never its value.
 
-The core detects credentials out of the box; PII detection is a
-separate activation, and it is process-wide and one-shot — the first selection
-wins, and a later *different* one fails with `PII_ACTIVATION_CONFLICT`.
+`test/otel-host.test.ts` builds a real span, passes it through a real
+`BasicTracerProvider`, and asserts the exporter saw redacted fields. That
+assertion is not optional.
 
-Either order works. Activate it yourself before building the provider:
+## Options
 
 ```js
-await initialize({ pii: ["pii:global"] });
-const processor = await createRedactingSpanProcessor(next); // accepted, not fought over
+await createRedactingSpanProcessor(next, { pii, onOutcome, policy, maxStringLength, operationLimits, scanLimits, ruleset, placeholderFormatter });
 ```
 
-or let the factory do it, which is the order to prefer when this adapter is the
-first thing in the process to touch the core:
+| Option | What it does |
+| --- | --- |
+| `pii` | Turn on PII detection, e.g. `["pii:global"]`. See below |
+| `onOutcome` | A callback with counts per span, for your metrics. See below |
+| `policy` | The core's policy, passed through unchanged. It replaces the core's built-in policy for every finding, a `ruleset` detector's included |
+| `scanLimits` | The core's whole-input limits, `{ maxInputBytes, maxFindings }`, for every scan. See [Core scan options](https://github.com/redact-secret/redact-secret-adapters/tree/main/packages/adapter#core-scan-options) |
+| `ruleset` | A declarative detector ruleset (text or bytes) |
+| `placeholderFormatter` | The core's placeholder formatter |
+| `maxStringLength` | Strings longer than this become `[REDACTED:LIMIT_EXCEEDED]` unscanned |
+| `operationLimits` | Override the aggregate budget of **one span**. See below |
+
+### One budget per span
+
+The span name, every attribute, every event and link, and the status message
+share **one** aggregate budget per span, so a span with many events and links
+cannot multiply the scanning even when each string is within `maxStringLength`.
+Past a bound every string not yet inspected becomes
+`[REDACTED:LIMIT_EXCEEDED]` unscanned and the span is still forwarded, never with
+text the budget did not allow to be inspected; nothing in `onOutcome` carries
+input. A key-context scan counts as a scan, and attribute names count as keys.
+A span ended re-entrantly inside the next processor has its own budget. Units,
+defaults and the caveat that this is a work counter and not a timeout are in
+[`@redact-secret/adapter`](https://github.com/redact-secret/redact-secret-adapters/tree/main/packages/adapter#aggregate-operation-budget).
+
+### PII detection
+
+The core detects credentials out of the box. PII detection is a separate
+activation:
 
 ```js
 const processor = await createRedactingSpanProcessor(next, { pii: ["pii:global"] });
 ```
 
-When you pass `pii`, the factory reads the core's `piiActivation()` afterwards
-and **rejects** if the active selection is not the one you asked for, rather
-than returning a processor that scans with PII silently off. The rejection
-carries a fixed `code` — `PII_ACTIVATION_NOT_ACTIVE`, or
-`PII_ACTIVATION_UNSUPPORTED` against a core too old to report an activation —
-and never echoes a selector, the input, or the core's own message. Omitting
-`pii` needs no newer core: the declared `@redact-secret/core` range is
-unchanged, and every other initialization failure still rejects exactly as it
-did.
-
-**Activation is not masking.** Under the core's default policy, PII types are
-confidence-gated rather than always redacted: a `High`-confidence finding
-redacts, while `Medium` and `Low` resolve to `warn` — and a `warn` finding
-leaves the text alone. Enabling PII therefore still lets lower-confidence PII
-reach the exporter as plaintext. Pass your own `policy` mapping those findings
-to `redact` if you need them masked; this package decides nothing about policy.
-The counters below make it visible: a span whose `values.findings` is non-zero
-while `values.redacted` stays at zero is exactly this case.
-
-## Counting what happened
-
-`onOutcome` reports one summary per **span**. It is
-observational: increment your own counters from it. This package creates no
-exporter or network client for you.
+It is process-wide and one-shot. If the selection you asked for is not the
+one active, the factory **rejects** with a fixed `code`
+(`PII_ACTIVATION_NOT_ACTIVE` or `PII_ACTIVATION_UNSUPPORTED`) rather than
+returning a processor that scans with PII silently off.
+
+**Activation is not masking.** Under the core's default policy only
+`High`-confidence PII is redacted; `Medium` and `Low` resolve to `warn`, which
+leaves the text alone. Pass your own `policy` if you need those masked. A span
+whose `values.findings` is non-zero while `values.redacted` stays at zero is
+exactly this case.
+
+Full rules:
+[PII guide](https://github.com/redact-secret/redact-secret-adapters/blob/main/docs/pii.md).
+
+### Counting what happened
+
+`onOutcome` reports one summary per **span**. It is observational: increment
+your own counters from it. This package creates no exporter or network client
+for you.
 
 ```js
 const processor = await createRedactingSpanProcessor(new BatchSpanProcessor(exporter), {
@@ -162,37 +188,47 @@ const processor = await createRedactingSpanProcessor(new BatchSpanProcessor(expo
   dropped: false }
 ```
 
-The counts are defined in
-[`@redact-secret/adapter`](../adapter#outcome-counters) — `findings` is not a
-count of distinct credentials, and `redacted` is lower than `findings` whenever
-a finding leaves text alone. Every string attribute, array element, event name
-and status message is its own counted leaf; attribute *names* are not scanned
-and not counted.
+- Every string attribute, array element, event name and status message is its
+  own counted leaf. Attribute *names* are not scanned and not counted.
+- `findings` is not a count of distinct credentials, and `redacted` is lower
+  than `findings` whenever a finding leaves text alone. The counts are defined
+  in
+  [`@redact-secret/adapter`](https://github.com/redact-secret/redact-secret-adapters/tree/main/packages/adapter#outcome-counters).
+- `dropped` is **this processor's** decision: it did not hand the span to the
+  next processor because a masked value would not write back. It does not mean
+  the span was sampled out, and `dropped: false` does **not** mean the span was
+  exported. Whether the next processor kept it and whether an exporter
+  succeeded are things this adapter never learns.
+- The observer runs once the span has been forwarded or dropped, so it cannot
+  change what is exported. Anything it throws is swallowed and never read.
+- It is re-entrancy-guarded: an observer that ends another span does not
+  recurse.
 
-`dropped` is **this processor's** decision: it did not hand the span to the
-next processor because a masked value would not write back (see the
-load-bearing assumption above). It does not mean the span was sampled out, and
-`dropped: false` does **not** mean the span was exported — whether the next
-processor kept it and whether an exporter succeeded are things this adapter
-never learns and does not report.
+## Exports
 
-- The observer runs once the span has been forwarded or dropped, so it cannot
-  change what is exported, and anything it throws is swallowed and never read.
-- It is re-entrancy- and thread-guarded: an observer that ends another span
-  does not recurse, and one thread's report never suppresses another's.
+| Export | Purpose |
+| --- | --- |
+| `createRedactingSpanProcessor(next, options?)` | Live: awaits the core's `initialize()`, wraps `next` |
+| `RedactingSpanProcessorWith` | `new (next, scanAndRedact, options?)`, with an injected scanner |
+| `redactAttributesWith(scanAndRedact, attributes, options?)` | Mutates one attribute bag in place; throws a `TypeError` (naming no value) if it cannot |
 
-## Supported SDK versions
+`options` is `{ policy, maxStringLength }` (`MaskLeafOptions`, re-exported
+here) plus `onOutcome` and, on the live factory, `pii`. The older
+`RedactAttributesOptions` alias is deprecated.
+
+## Supported versions
 
 `@opentelemetry/sdk-trace-base ^2.0.0` and `@redact-secret/core`
 `^0.1.0-beta.6`. CI runs the real-host tests at both ends of each range. The
-SDK is imported as types only — it never enters this package's runtime graph.
+SDK is imported as types only. It never enters this package's runtime graph.
 
 ## Migrating from `@redact-secret/adapter-otel`
 
-`0.1.0` of this package is the code `@redact-secret/adapter-otel` `0.1.2`
-shipped: the same exports, options, outcome shape, peer ranges and fail-closed
-markers. Only the name changes, so migrating is a dependency swap and an import
-specifier:
+This package was published as
+[`@redact-secret/adapter-otel`](https://www.npmjs.com/package/@redact-secret/adapter-otel)
+up to `0.1.2`. `0.1.0` of this package is that same code: the same exports,
+options, outcome shape, peer ranges and fail-closed markers. Only the name
+changes, so migrating is a dependency swap and an import specifier:
 
 ```sh
 npm uninstall @redact-secret/adapter-otel
@@ -204,15 +240,20 @@ npm install @redact-secret/adapter-otel-trace
 +import { createRedactingSpanProcessor } from "@redact-secret/adapter-otel-trace";
 ```
 
-Nothing breaks if you do not migrate yet. `@redact-secret/adapter-otel`
-`0.1.2` is this code under the old name, and its later releases re-export this
-package, so both names hand out the same functions and the same
-`RedactingSpanProcessorWith` class and mixing them in one process is safe.
-Those later releases mark every export `@deprecated`, which editors show as a
-strikethrough.
+Nothing breaks if you do not migrate yet. Later releases of
+`@redact-secret/adapter-otel` re-export this package, so both names hand out
+the same functions and the same `RedactingSpanProcessorWith` class, and mixing
+them in one process is safe. Those releases mark every export `@deprecated`,
+which editors show as a strikethrough.
 
 Neither name protects OpenTelemetry Logs, before or after migrating.
 
+## Contributing
+
+Issues and pull requests are welcome:
+[CONTRIBUTING.md](https://github.com/redact-secret/redact-secret-adapters/blob/main/CONTRIBUTING.md).
+Changes are listed in this package's `CHANGELOG.md`.
+
 ## License
 
 MIT

package/dist/index.js

@@ -27,7 +27,7 @@
  * PII off. See `@redact-secret/adapter`'s `activateCore` for the whole rule,
  * including why activation is not the same as masking every PII value.
  */
-import { activateCore } from "@redact-secret/adapter";
+import { activateCore, resolveScanConfig, verifyScanOptions } from "@redact-secret/adapter";
 import { RedactingSpanProcessorWith } from "./span-processor.js";
 export { RedactingSpanProcessorWith, redactAttributesWith, } from "./span-processor.js";
 /**
@@ -44,7 +44,11 @@ export async function createRedactingSpanProcessor(next, options = {}) {
     // `options` is forwarded as the same object so every other inherited key
     // does too. `pii` rides along unread, as any unknown key would.
     const activation = options.pii === undefined ? {} : { pii: options.pii };
+    // Validated before the core is touched; then the installed core must honor
+    // any requested scan option or this rejects with a fixed `CoreOptionsError`.
+    const config = resolveScanConfig(options);
     const loaded = await import("@redact-secret/core");
     await activateCore(loaded, activation);
+    verifyScanOptions(loaded, config);
     return new RedactingSpanProcessorWith(next, loaded.scanAndRedact, options);
 }

package/dist/span-processor.d.ts

@@ -26,7 +26,7 @@
  * plain object.
  */
 import type { ReadableSpan, Span, SpanProcessor } from "@opentelemetry/sdk-trace-base";
-import type { MaskLeafOptions, ScanAndRedact, ValueCounts } from "@redact-secret/adapter";
+import type { MaskLeafOptions, OperationLimits, ScanAndRedact, ValueCounts } from "@redact-secret/adapter";
 /**
  * @deprecated Use `MaskLeafOptions` (`{ policy, maxStringLength }`), which
  * this package re-exports; this alias adds nothing and will be removed in a
@@ -52,7 +52,16 @@ export interface OtelSpanOutcome {
      */
     readonly dropped: boolean;
 }
-export interface RedactingSpanProcessorOptions extends MaskLeafOptions {
+export interface RedactingSpanProcessorOptions extends Omit<MaskLeafOptions, "budget"> {
+    /**
+     * Overrides for the aggregate budget of **one span** (see
+     * `@redact-secret/adapter`'s `budget.ts`), shared by the span name, every
+     * attribute, event and link and the status message. Past it, every string
+     * not yet inspected becomes `[REDACTED:LIMIT_EXCEEDED]` and the core is not
+     * called; the span is still forwarded, never with text the budget did not
+     * allow to be inspected. It is a work counter, not a wall-clock timeout.
+     */
+    readonly operationLimits?: Partial<OperationLimits> | undefined;
     /**
      * Observational: called once per span, synchronously at the end of `onEnd`,
      * after the span has either been forwarded or dropped. Increment your own

package/dist/span-processor.js

@@ -25,37 +25,51 @@
  * wrapping one needs no dependency, and this module is testable with a
  * plain object.
  */
-import { countLeaf, createOutcomeCounter, ERROR_MARKER, maskLeafOutcomeWith, notify, toValueCounts, } from "@redact-secret/adapter";
+import { countLeaf, createOperationBudget, createOutcomeCounter, ERROR_MARKER, LIMIT_MARKER, maskLeafOutcomeWith, notify, resolveScanConfig, toValueCounts, } from "@redact-secret/adapter";
 /** A span field that did not take a masked write. The message names the field, never its value. */
 class UnredactableFieldError extends Error {
 }
 /**
- * `counter` is read on every call, not captured, so one masker serves every
- * span and the processor can swap in a fresh per-span counter.
+ * `state` is read on every call, not captured, so one masker serves every
+ * span and the processor can swap in a fresh per-span counter and budget.
  */
-function maskerFor(scanAndRedact, options, counter) {
-    return (text) => {
+function maskerFor(scanAndRedact, options, state) {
+    return (text, key) => {
+        const { counter, budget } = state();
         try {
-            const leaf = maskLeafOutcomeWith(scanAndRedact, text, options);
+            // One leaf of the span's budget; the scans it makes are charged inside.
+            if (!budget.chargeLeaf()) {
+                if (counter !== undefined)
+                    counter.limited += 1;
+                return LIMIT_MARKER;
+            }
+            const leaf = maskLeafOutcomeWith(scanAndRedact, text, { ...options, key, budget });
             if (counter !== undefined)
-                countLeaf(counter(), leaf);
+                countLeaf(counter, leaf);
             return leaf.text;
         }
         catch {
             if (counter !== undefined)
-                counter().failed += 1;
+                counter.failed += 1;
             return ERROR_MARKER;
         }
     };
 }
 /** The masked value, or `value` itself when nothing in it changed. */
-function maskAttributeValue(mask, value) {
+function maskAttributeValue(mask, budget, value, key) {
+    // Every value, and every element of an array value, is a node of the span's budget.
+    budget.chargeNode();
     if (typeof value === "string")
-        return mask(value);
+        return mask(value, key);
     if (Array.isArray(value)) {
         // OpenTelemetry allows null/undefined holes in a homogeneous array, so
         // every string element is masked and every other element kept in place.
-        const masked = value.map((item) => (typeof item === "string" ? mask(item) : item));
+        // An element is not directly under the attribute's name, so it is masked
+        // without key context, as an array element is everywhere else.
+        const masked = value.map((item) => {
+            budget.chargeNode();
+            return typeof item === "string" ? mask(item) : item;
+        });
         return masked.some((item, index) => item !== value[index]) ? masked : value;
     }
     // Numbers and booleans cannot carry a secret as free text.
@@ -75,11 +89,14 @@ function writeBack(target, key, value, field) {
     if (record[key] !== value)
         throw new UnredactableFieldError(`${field} did not take the masked write`);
 }
-function redactBag(mask, bag, field) {
+function redactBag(mask, budget, bag, field) {
     if (bag == null)
         return;
     for (const key of Object.keys(bag)) {
-        writeBack(bag, key, maskAttributeValue(mask, bag[key]), field);
+        // Charged as a key occurrence. Failing it exhausts the budget, and every
+        // string from here on is replaced by a marker rather than inspected.
+        budget.chargeKey();
+        writeBack(bag, key, maskAttributeValue(mask, budget, bag[key], key), field);
     }
 }
 /**
@@ -87,31 +104,39 @@ function redactBag(mask, bag, field) {
  * `TypeError` naming no value if a masked value cannot be written back.
  */
 export function redactAttributesWith(scanAndRedact, attributes, options = {}) {
+    const { operationLimits, ...leafOptions } = options;
+    const budget = createOperationBudget(operationLimits);
+    const resolved = { ...leafOptions, scanConfig: leafOptions.scanConfig ?? resolveScanConfig(leafOptions) };
     try {
-        redactBag(maskerFor(scanAndRedact, options), attributes, "attributes");
+        redactBag(maskerFor(scanAndRedact, resolved, () => ({ counter: undefined, budget })), budget, attributes, "attributes");
     }
     catch {
         throw new TypeError("redactAttributesWith: a masked attribute could not be written back");
     }
 }
-function redactSpan(mask, span) {
-    if (typeof span.name === "string")
+function redactSpan(mask, budget, span) {
+    if (typeof span.name === "string") {
+        budget.chargeNode();
         writeBack(span, "name", mask(span.name), "span.name");
-    redactBag(mask, span.attributes, "span.attributes");
+    }
+    redactBag(mask, budget, span.attributes, "span.attributes");
     const status = span.status;
     if (typeof status?.message === "string") {
+        budget.chargeNode();
         const message = mask(status.message);
         // Replaced, not mutated: the status object may be the caller's own.
         if (message !== status.message)
             writeBack(span, "status", { ...status, message }, "span.status");
     }
     for (const [index, event] of (span.events ?? []).entries()) {
+        budget.chargeNode();
         if (typeof event.name === "string")
             writeBack(event, "name", mask(event.name), `span.events[${index}].name`);
-        redactBag(mask, event.attributes, `span.events[${index}].attributes`);
+        redactBag(mask, budget, event.attributes, `span.events[${index}].attributes`);
     }
     for (const [index, link] of (span.links ?? []).entries()) {
-        redactBag(mask, link.attributes, `span.links[${index}].attributes`);
+        budget.chargeNode();
+        redactBag(mask, budget, link.attributes, `span.links[${index}].attributes`);
     }
 }
 /**
@@ -125,6 +150,10 @@ export class RedactingSpanProcessorWith {
     #mask;
     #onOutcome;
     #counter = createOutcomeCounter();
+    // The span being masked right now: one budget per `onEnd`, swapped like the
+    // counter so a downstream processor that ends a span re-entrantly has its own.
+    #budget;
+    #limits;
     #reporting = false;
     #warned = false;
     constructor(next, scanAndRedact, options = {}) {
@@ -134,13 +163,22 @@ export class RedactingSpanProcessorWith {
         if (typeof scanAndRedact !== "function") {
             throw new TypeError("RedactingSpanProcessorWith: scanAndRedact must be a function");
         }
-        const { onOutcome, ...maskOptions } = options;
+        const { onOutcome, operationLimits, ...rawOptions } = options;
+        // Validated and snapshotted once, here: a malformed scan option is a
+        // programming error at construction, and every leaf is scanned with the
+        // one snapshot.
+        const maskOptions = { ...rawOptions, scanConfig: rawOptions.scanConfig ?? resolveScanConfig(rawOptions) };
         if (onOutcome !== undefined && typeof onOutcome !== "function") {
             throw new TypeError("RedactingSpanProcessorWith: onOutcome must be a function");
         }
         this.#next = next;
         this.#onOutcome = onOutcome;
-        this.#mask = maskerFor(scanAndRedact, maskOptions, onOutcome === undefined ? undefined : () => this.#counter);
+        this.#limits = operationLimits;
+        this.#budget = createOperationBudget(operationLimits);
+        this.#mask = maskerFor(scanAndRedact, maskOptions, () => ({
+            counter: onOutcome === undefined ? undefined : this.#counter,
+            budget: this.#budget,
+        }));
     }
     onStart(...args) {
         this.#next.onStart?.(...args);
@@ -162,13 +200,15 @@ export class RedactingSpanProcessorWith {
         // `SimpleSpanProcessor` over an instrumented exporter, or any processor
         // that emits a span of its own), which re-enters this method.
         const outer = this.#counter;
+        const outerBudget = this.#budget;
         if (counting)
             this.#counter = createOutcomeCounter();
+        this.#budget = createOperationBudget(this.#limits);
         let dropped = false;
         let counts;
         try {
             try {
-                redactSpan(this.#mask, span);
+                redactSpan(this.#mask, this.#budget, span);
             }
             catch (error) {
                 this.#warnDropped(error instanceof UnredactableFieldError ? error.message : "unexpected span shape");
@@ -182,6 +222,7 @@ export class RedactingSpanProcessorWith {
         }
         finally {
             this.#counter = outer;
+            this.#budget = outerBudget;
         }
         // Reported whether the span was forwarded or dropped, and after the next
         // processor has had it, so an observer cannot affect what is exported.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redact-secret/adapter-otel-trace",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "A redacting OpenTelemetry JS SpanProcessor (traces only) over the Redact Secret core.",
   "license": "MIT",
   "type": "module",
@@ -35,7 +35,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@redact-secret/adapter": "^0.1.3"
+    "@redact-secret/adapter": "^0.1.7"
   },
   "peerDependencies": {
     "@opentelemetry/sdk-trace-base": "^2.0.0",