@redact-secret/adapter-otel-trace 0.1.3 → 0.1.5

package/CHANGELOG.md

@@ -25,6 +25,24 @@ version numbers start again here, at `0.1.0`, and do not follow the old name's.
 
 ## [Unreleased]
 
+## [0.1.5] - 2026-10-07
+
+### Changed
+
+- **Breaking for consumers on Node 20: Node 20 is no longer supported.** `engines.node` is now `22.x || 24.x` (was `20.x || 22.x || 24.x`) and CI no longer runs Node 20. The code is unchanged, but a Node 20 install now warns (an error under `engine-strict`) and is not tested; stay on the previous release if you must run Node 20. Shipped in a patch release at the maintainer's decision, although it is a breaking engines change.
+
+## [0.1.4] - 2026-10-07
+
+### Changed
+
+- Requires `@redact-secret/adapter` `^0.1.9` (was `^0.1.7`) for `actionPolicy`, `scanConfigOf` and the scan-config conflict contract. Backed by the live tests of this package and CI's `published-combination` job.
+- Verified against `@redact-secret/core` 0.1.0-beta.14. The declared core range is unchanged.
+- `createRedactingSpanProcessor`: an injected `scanConfig` beside any loose scan option (`policy`, `actionPolicy`, `scanLimits`, `ruleset`, `placeholderFormatter`) is rejected with a fixed `TypeError` before the core is loaded, instead of the config silently winning; the injected configuration is the one verified against the core (redact-secret-adapters#213). Needs `@redact-secret/adapter` with `scanConfigOf`. Test: `test/injected-scan-config-live.test.ts`.
+
+### Added
+
+- `actionPolicy` on `createRedactingSpanProcessor`, applied to every string of a span (name, attributes, events, links), with the shared snapshot, callback-conflict and capability checks of `@redact-secret/adapter` (redact-secret-adapters#217). Needs `@redact-secret/core` 0.1.0-beta.14 or later (the first published release that accepts it); an older core is rejected by name with `CoreOptionsError` (`CORE_OPTION_UNSUPPORTED`) and every other option keeps working on the declared floor. The package range is unchanged; the new tests in `compatibility.json` run at both endpoints (the option applies at the upper one, is rejected at the lower one). Test: `test/action-policy-live.test.ts` (the exported span for each action).
+
 ## [0.1.3] - 2026-10-03
 ### Changed
 

package/README.md

@@ -22,7 +22,7 @@ core, which does the detection.
 npm install @redact-secret/core @redact-secret/adapter-otel-trace @opentelemetry/sdk-trace-base
 ```
 
-Needs Node.js 20, 22 or 24 and `@opentelemetry/sdk-trace-base ^2.0.0`. ESM only.
+Needs Node.js 22 or 24 and `@opentelemetry/sdk-trace-base ^2.0.0`. ESM only.
 
 ## Quick start
 
@@ -92,7 +92,7 @@ Attribute names are not allowlisted, so OpenInference (`llm.input_messages`,
 **This is a trace processor only.** A `LogRecord` never passes through it and
 reaches its exporter as it was written. For logs use
 [`@redact-secret/adapter-otel-logs`](https://github.com/redact-secret/redact-secret-adapters/tree/main/packages/adapter-otel-logs),
-a separate package currently published as a beta (`0.1.0-beta.2`, dist-tag `beta`).
+a separate package currently published as a beta (`0.1.0-beta.4`, dist-tag `beta`).
 
 When a value cannot be scanned, a fixed marker replaces it. See
 [`@redact-secret/adapter`](https://github.com/redact-secret/redact-secret-adapters/tree/main/packages/adapter#fail-closed-markers)
@@ -117,7 +117,7 @@ assertion is not optional.
 ## Options
 
 ```js
-await createRedactingSpanProcessor(next, { pii, onOutcome, policy, maxStringLength, operationLimits, scanLimits, ruleset, placeholderFormatter });
+await createRedactingSpanProcessor(next, { pii, onOutcome, policy, maxStringLength, operationLimits, scanLimits, ruleset, placeholderFormatter, actionPolicy });
 ```
 
 | Option | What it does |
@@ -128,6 +128,7 @@ await createRedactingSpanProcessor(next, { pii, onOutcome, policy, maxStringLeng
 | `scanLimits` | The core's whole-input limits, `{ maxInputBytes, maxFindings }`, for every scan. See [Core scan options](https://github.com/redact-secret/redact-secret-adapters/tree/main/packages/adapter#core-scan-options) |
 | `ruleset` | A declarative detector ruleset (text or bytes) |
 | `placeholderFormatter` | The core's placeholder formatter |
+| `actionPolicy` | The core's declarative action policy (object, JSON text or bytes), for every string of a span. Mutually exclusive with `policy`; needs core `0.1.0-beta.14` or later, else construction rejects with `CoreOptionsError`. See [Declarative `actionPolicy`](https://github.com/redact-secret/redact-secret-adapters/tree/main/packages/adapter#declarative-actionpolicy) |
 | `maxStringLength` | Strings longer than this become `[REDACTED:LIMIT_EXCEEDED]` unscanned |
 | `operationLimits` | Override the aggregate budget of **one span**. See below |
 

package/dist/index.js

@@ -27,7 +27,7 @@
  * PII off. See `@redact-secret/adapter`'s `activateCore` for the whole rule,
  * including why activation is not the same as masking every PII value.
  */
-import { activateCore, resolveScanConfig, verifyScanOptions } from "@redact-secret/adapter";
+import { activateCore, scanConfigOf, verifyScanOptions } from "@redact-secret/adapter";
 import { RedactingSpanProcessorWith } from "./span-processor.js";
 export { RedactingSpanProcessorWith, redactAttributesWith, } from "./span-processor.js";
 /**
@@ -46,7 +46,7 @@ export async function createRedactingSpanProcessor(next, options = {}) {
     const activation = options.pii === undefined ? {} : { pii: options.pii };
     // Validated before the core is touched; then the installed core must honor
     // any requested scan option or this rejects with a fixed `CoreOptionsError`.
-    const config = resolveScanConfig(options);
+    const config = scanConfigOf(options);
     const loaded = await import("@redact-secret/core");
     await activateCore(loaded, activation);
     verifyScanOptions(loaded, config);

package/dist/span-processor.js

@@ -25,7 +25,7 @@
  * wrapping one needs no dependency, and this module is testable with a
  * plain object.
  */
-import { countLeaf, createOperationBudget, createOutcomeCounter, ERROR_MARKER, LIMIT_MARKER, maskLeafOutcomeWith, notify, resolveScanConfig, toValueCounts, } from "@redact-secret/adapter";
+import { bindScanConfig, countLeaf, createOperationBudget, createOutcomeCounter, ERROR_MARKER, LIMIT_MARKER, maskLeafOutcomeWith, notify, toValueCounts, } from "@redact-secret/adapter";
 /** A span field that did not take a masked write. The message names the field, never its value. */
 class UnredactableFieldError extends Error {
 }
@@ -106,7 +106,7 @@ function redactBag(mask, budget, bag, field) {
 export function redactAttributesWith(scanAndRedact, attributes, options = {}) {
     const { operationLimits, ...leafOptions } = options;
     const budget = createOperationBudget(operationLimits);
-    const resolved = { ...leafOptions, scanConfig: leafOptions.scanConfig ?? resolveScanConfig(leafOptions) };
+    const resolved = bindScanConfig(leafOptions);
     try {
         redactBag(maskerFor(scanAndRedact, resolved, () => ({ counter: undefined, budget })), budget, attributes, "attributes");
     }
@@ -167,7 +167,7 @@ export class RedactingSpanProcessorWith {
         // Validated and snapshotted once, here: a malformed scan option is a
         // programming error at construction, and every leaf is scanned with the
         // one snapshot.
-        const maskOptions = { ...rawOptions, scanConfig: rawOptions.scanConfig ?? resolveScanConfig(rawOptions) };
+        const maskOptions = bindScanConfig(rawOptions);
         if (onOutcome !== undefined && typeof onOutcome !== "function") {
             throw new TypeError("RedactingSpanProcessorWith: onOutcome must be a function");
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redact-secret/adapter-otel-trace",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "A redacting OpenTelemetry JS SpanProcessor (traces only) over the Redact Secret core.",
   "license": "MIT",
   "type": "module",
@@ -19,7 +19,7 @@
     "LICENSE"
   ],
   "engines": {
-    "node": "20.x || 22.x || 24.x"
+    "node": "22.x || 24.x"
   },
   "repository": {
     "type": "git",
@@ -35,7 +35,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@redact-secret/adapter": "^0.1.7"
+    "@redact-secret/adapter": "^0.1.9"
   },
   "peerDependencies": {
     "@opentelemetry/sdk-trace-base": "^2.0.0",