@rootcat/node 0.0.0-stage → 0.1.0

package/dist/pgpool.d.ts

@@ -0,0 +1,13 @@
+import { InstrumentationBase, type InstrumentationConfig, InstrumentationNodeModuleDefinition } from '@opentelemetry/instrumentation';
+import { type CallSiteSampling } from './processor.js';
+/** PgPoolEntryOptions bounds and gates the capture. */
+export interface PgPoolEntryOptions extends InstrumentationConfig {
+    depth: number;
+    sampling: CallSiteSampling;
+    isApp?: (file: string) => boolean;
+}
+export declare class PgPoolEntryInstrumentation extends InstrumentationBase<PgPoolEntryOptions> {
+    constructor(options: PgPoolEntryOptions);
+    protected init(): InstrumentationNodeModuleDefinition;
+    private readonly wrapQuery;
+}

package/dist/pgpool.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PgPoolEntryInstrumentation = void 0;
+// pg-pool entry. Pool.prototype.query hands the query to a client on a
+// later tick, so the pg query span's stack never shows the caller: this
+// wrapper captures the call site where the application calls pool.query
+// and carries it in the active context to the span that starts later.
+//
+// Pool.prototype.connect queues its callback when every client is busy
+// and runs it from the release of another client, in that client's
+// query's context. Its callback is bound to the context of the connect
+// call, so a queued query keeps its own call site and its own parent
+// instead of borrowing the query that freed the client.
+const api_1 = require("@opentelemetry/api");
+const instrumentation_1 = require("@opentelemetry/instrumentation");
+const callsite_js_1 = require("./callsite.js");
+const processor_js_1 = require("./processor.js");
+function poolPrototype(moduleExports) {
+    const proto = moduleExports?.prototype;
+    return proto && typeof proto.query === 'function' && typeof proto.connect === 'function' ? proto : undefined;
+}
+class PgPoolEntryInstrumentation extends instrumentation_1.InstrumentationBase {
+    constructor(options) {
+        super('@rootcat/node/pg-pool-entry', '0.1.0', options);
+    }
+    init() {
+        return new instrumentation_1.InstrumentationNodeModuleDefinition('pg-pool', ['>=2.0.0 <4'], (moduleExports) => {
+            const proto = poolPrototype(moduleExports);
+            if (proto) {
+                for (const name of ['query', 'connect']) {
+                    if ((0, instrumentation_1.isWrapped)(proto[name])) {
+                        this._unwrap(proto, name);
+                    }
+                }
+                this._wrap(proto, 'query', this.wrapQuery);
+                this._wrap(proto, 'connect', wrapConnect);
+            }
+            return moduleExports;
+        }, (moduleExports) => {
+            const proto = poolPrototype(moduleExports);
+            if (proto) {
+                this._unwrap(proto, 'query');
+                this._unwrap(proto, 'connect');
+            }
+        });
+    }
+    wrapQuery = (original) => {
+        const instrumentation = this;
+        return function query(...args) {
+            let carried;
+            try {
+                // A callback continues in the caller's context, never in the
+                // query's: a query issued from it captures its own site.
+                const last = args.length - 1;
+                if (last >= 0 && typeof args[last] === 'function') {
+                    args[last] = api_1.context.bind(api_1.context.active(), args[last]);
+                }
+                const config = instrumentation.getConfig();
+                carried = config.sampling.carry(() => (0, callsite_js_1.captureCallSite)(config.depth, config.isApp, query));
+            }
+            catch {
+                carried = undefined;
+            }
+            return (0, processor_js_1.runCarried)(carried, () => original.apply(this, args));
+        };
+    };
+}
+exports.PgPoolEntryInstrumentation = PgPoolEntryInstrumentation;
+/**
+ * wrapConnect binds a connect callback to the context of the call, and
+ * runs the pool's own work (opening a client and its socket) in the root
+ * context: a connection outlives the query that opened it, and the events
+ * it emits later (a LISTEN notification, an error) must not run in that
+ * query's context, with its span and call site.
+ */
+function wrapConnect(original) {
+    return function connect(...args) {
+        const callback = args[0];
+        if (typeof callback === 'function') {
+            args[0] = api_1.context.bind(api_1.context.active(), callback);
+        }
+        return api_1.context.with(api_1.ROOT_CONTEXT, () => original.apply(this, args));
+    };
+}
+//# sourceMappingURL=pgpool.js.map

package/dist/pgpool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pgpool.js","sourceRoot":"","sources":["../src/pgpool.ts"],"names":[],"mappings":";;;AAAA,uEAAuE;AACvE,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,uEAAuE;AACvE,qEAAqE;AACrE,wDAAwD;AACxD,4CAA2D;AAC3D,oEAAiJ;AACjJ,+CAAgD;AAChD,iDAAmE;AAYnE,SAAS,aAAa,CAAC,aAAsB;IAC3C,MAAM,KAAK,GAAI,aAA+D,EAAE,SAAS,CAAC;IAC1F,OAAO,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAE,KAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;AAClI,CAAC;AAED,MAAa,0BAA2B,SAAQ,qCAAuC;IACrF,YAAY,OAA2B;QACrC,KAAK,CAAC,6BAA6B,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAES,IAAI;QACZ,OAAO,IAAI,qDAAmC,CAC5C,SAAS,EACT,CAAC,YAAY,CAAC,EACd,CAAC,aAAsB,EAAE,EAAE;YACzB,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;YAC3C,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS,CAAU,EAAE,CAAC;oBACjD,IAAI,IAAA,2BAAS,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;wBAC3B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC3C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,aAAa,CAAC;QACvB,CAAC,EACD,CAAC,aAAsB,EAAE,EAAE;YACzB,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;YAC3C,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACjC,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAEgB,SAAS,GAAG,CAAC,QAAgB,EAAU,EAAE;QACxD,MAAM,eAAe,GAAG,IAAI,CAAC;QAC7B,OAAO,SAAS,KAAK,CAAgB,GAAG,IAAe;YACrD,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBACH,6DAA6D;gBAC7D,yDAAyD;gBACzD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC7B,IAAI,IAAI,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;oBAClD,IAAI,CAAC,IAAI,CAAC,GAAG,aAAO,CAAC,IAAI,CAAC,aAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,IAAI,CAAW,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,CAAC;gBAC3C,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAA,6BAAe,EAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YAC5F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,SAAS,CAAC;YACtB,CAAC;YACD,OAAO,IAAA,yBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC;IACJ,CAAC,CAAC;CACH;AAnDD,gEAmDC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,QAAgB;IACnC,OAAO,SAAS,OAAO,CAAgB,GAAG,IAAe;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC,CAAC,CAAC,GAAG,aAAO,CAAC,IAAI,CAAC,aAAO,CAAC,MAAM,EAAE,EAAE,QAAkB,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,aAAO,CAAC,IAAI,CAAC,kBAAY,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC;AACJ,CAAC"}

package/dist/postgresjs.d.ts

@@ -0,0 +1,33 @@
+import { InstrumentationBase, type InstrumentationConfig, InstrumentationNodeModuleDefinition } from '@opentelemetry/instrumentation';
+import { type CallSiteSampling } from './processor.js';
+/** PostgresJsOptions configures the instrumentation. */
+export interface PostgresJsOptions extends InstrumentationConfig {
+    /** sampling gates the origin parsing, like any capture. */
+    sampling: CallSiteSampling;
+}
+export declare class PostgresJsInstrumentation extends InstrumentationBase<PostgresJsOptions> {
+    private readonly patched;
+    /** origins remembers the parsed call site per template, null for none. */
+    private readonly origins;
+    constructor(options: PostgresJsOptions);
+    protected init(): InstrumentationNodeModuleDefinition;
+    /**
+     * patchModule wraps the factory. CommonJS exports the function itself
+     * (the wrapper is returned in its place); an ES module namespace has it
+     * as default (replaced in place).
+     */
+    private patchModule;
+    private unpatchModule;
+    private wrapFactory;
+    /** patchQueryClass finds Query.prototype through an unexecuted query. */
+    private patchQueryClass;
+    private readonly wrapHandle;
+    /**
+     * originSite is the application frame of the driver's own origin stack
+     * for a tagged query, parsed once per template; undefined for unsafe()
+     * and file() queries, which hold no origin.
+     */
+    private originSite;
+    private startQuerySpan;
+    private endQuerySpan;
+}

package/dist/postgresjs.js

@@ -0,0 +1,272 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PostgresJsInstrumentation = void 0;
+// postgres.js (the `postgres` package) has no upstream instrumentation.
+// Its Query is a lazy promise: nothing runs until .then, .execute or
+// .forEach calls handle(). An awaited Query is a Promise subclass, so the
+// await calls then() from a job of its own, where no application frame
+// is on the stack. The driver itself keeps a short stack per tagged
+// template (query.origin, four frames, cached per template), which is
+// where the span's call site comes from: parsed once per template.
+// The span starts in handle() on the first execution and ends when the
+// query resolves or rejects. The statement text is what the driver built
+// (query.statement.string, with $1 placeholders); the span never touches
+// query.args.
+//
+// The Query class is internal to the module, so the module's default
+// export (the postgres() factory) is wrapped: the first sql function it
+// returns yields the class through an unexecuted query, and handle() is
+// patched on that prototype once. The same wrapper serves the CommonJS
+// and the ES module builds.
+const api_1 = require("@opentelemetry/api");
+const instrumentation_1 = require("@opentelemetry/instrumentation");
+const callsite_js_1 = require("./callsite.js");
+const privacy_js_1 = require("./privacy.js");
+const processor_js_1 = require("./processor.js");
+/** Bounds. */
+const maxStatementBytes = 4096;
+const supportedVersions = ['>=3.0.0 <4'];
+const rootcatSpan = Symbol('rootcat.span');
+const rootcatWrapped = Symbol('rootcat.wrapped');
+const rootcatOptions = Symbol('rootcat.options');
+/** probe is a template that is never executed; it only yields the class. */
+const probe = Object.freeze(Object.assign(['select 1'], { raw: Object.freeze(['select 1']) }));
+class PostgresJsInstrumentation extends instrumentation_1.InstrumentationBase {
+    patched = new WeakSet();
+    /** origins remembers the parsed call site per template, null for none. */
+    origins = new WeakMap();
+    constructor(options) {
+        super('@rootcat/node/postgres-js', '0.1.0', options);
+    }
+    init() {
+        return new instrumentation_1.InstrumentationNodeModuleDefinition('postgres', supportedVersions, (moduleExports) => this.patchModule(moduleExports), (moduleExports) => this.unpatchModule(moduleExports));
+    }
+    /**
+     * patchModule wraps the factory. CommonJS exports the function itself
+     * (the wrapper is returned in its place); an ES module namespace has it
+     * as default (replaced in place).
+     */
+    patchModule(moduleExports) {
+        const ns = moduleExports;
+        if (typeof ns === 'function') {
+            return this.wrapFactory(ns);
+        }
+        if (ns && typeof ns.default === 'function') {
+            try {
+                ns.default = this.wrapFactory(ns.default);
+            }
+            catch {
+                // a frozen namespace: no postgres.js spans
+            }
+        }
+        return moduleExports;
+    }
+    unpatchModule(moduleExports) {
+        const ns = moduleExports;
+        const wrapped = typeof ns === 'function' ? ns : ns?.default;
+        const original = wrapped?.[rootcatWrapped];
+        if (original && typeof ns !== 'function' && ns) {
+            ns.default = original;
+        }
+    }
+    wrapFactory(original) {
+        const marked = original;
+        if (marked[rootcatWrapped]) {
+            return original;
+        }
+        const instrumentation = this;
+        const wrapper = function postgres(...args) {
+            const sql = original.apply(this, args);
+            try {
+                instrumentation.patchQueryClass(sql);
+            }
+            catch {
+                // the driver works untraced
+            }
+            return sql;
+        };
+        Object.assign(wrapper, original);
+        Object.setPrototypeOf(wrapper, Object.getPrototypeOf(original));
+        wrapper[rootcatWrapped] = original;
+        return wrapper;
+    }
+    /** patchQueryClass finds Query.prototype through an unexecuted query. */
+    patchQueryClass(sql) {
+        if (typeof sql !== 'function') {
+            return;
+        }
+        const query = sql(probe);
+        if (!query || typeof query !== 'object') {
+            return;
+        }
+        const proto = Object.getPrototypeOf(query);
+        if (!proto || typeof proto.handle !== 'function') {
+            return;
+        }
+        // The connection options live on the sql function; the queries of
+        // this instance reach them through their handler.
+        if (typeof query.handler === 'function' && sql.options && typeof sql.options === 'object') {
+            query.handler[rootcatOptions] = sql.options;
+        }
+        if (this.patched.has(proto)) {
+            return;
+        }
+        this.patched.add(proto);
+        if ((0, instrumentation_1.isWrapped)(proto.handle)) {
+            this._unwrap(proto, 'handle');
+        }
+        this._wrap(proto, 'handle', this.wrapHandle);
+    }
+    wrapHandle = (original) => {
+        const instrumentation = this;
+        return function handle(...args) {
+            if (this.executed || this[rootcatSpan]) {
+                return original.apply(this, args);
+            }
+            let span;
+            try {
+                span = instrumentation.startQuerySpan(this);
+            }
+            catch {
+                span = undefined;
+            }
+            if (!span) {
+                return original.apply(this, args);
+            }
+            this[rootcatSpan] = span;
+            const resolve = this.resolve;
+            const reject = this.reject;
+            const query = this;
+            if (typeof resolve === 'function') {
+                this.resolve = function (value) {
+                    instrumentation.endQuerySpan(query, span, undefined);
+                    return resolve.call(this, value);
+                };
+            }
+            if (typeof reject === 'function') {
+                this.reject = function (reason) {
+                    instrumentation.endQuerySpan(query, span, reason);
+                    return reject.call(this, reason);
+                };
+            }
+            return original.apply(this, args);
+        };
+    };
+    /**
+     * originSite is the application frame of the driver's own origin stack
+     * for a tagged query, parsed once per template; undefined for unsafe()
+     * and file() queries, which hold no origin.
+     */
+    originSite(query) {
+        const strings = query.strings;
+        if (!query.tagged || !strings || typeof strings !== 'object') {
+            return undefined;
+        }
+        const known = this.origins.get(strings);
+        if (known !== undefined) {
+            return known ?? undefined;
+        }
+        let site;
+        try {
+            const origin = query.origin;
+            site = typeof origin === 'string' ? (0, callsite_js_1.parseStack)(origin) : undefined;
+        }
+        catch {
+            site = undefined;
+        }
+        this.origins.set(strings, site ?? null);
+        return site;
+    }
+    startQuerySpan(query) {
+        // The template's own origin (free: parsed once per template) wins over
+        // a site carried from outside, as a query written in the continuation
+        // of another is its own; unsafe() queries keep what an ORM carried.
+        const ctx = this.getConfig().sampling.carry(() => this.originSite(query), true) ?? api_1.context.active();
+        if ((0, processor_js_1.unsampled)(ctx)) {
+            return undefined; // not recorded: the query runs untouched
+        }
+        const options = query.handler?.[rootcatOptions];
+        const keyword = (0, privacy_js_1.statementKeyword)(leadingText(query));
+        const attributes = { 'db.system.name': 'postgresql' };
+        if (keyword !== '') {
+            attributes['db.operation.name'] = keyword;
+        }
+        if (options) {
+            if (typeof options.database === 'string') {
+                attributes['db.namespace'] = options.database;
+            }
+            const host = Array.isArray(options.host) ? options.host[0] : options.host;
+            if (typeof host === 'string') {
+                attributes['server.address'] = host;
+            }
+            const port = Array.isArray(options.port) ? options.port[0] : options.port;
+            if (typeof port === 'number') {
+                attributes['server.port'] = port;
+            }
+        }
+        const name = keyword === '' ? 'postgres.query' : `postgres.query:${keyword}`;
+        return this.tracer.startSpan(name, { kind: api_1.SpanKind.CLIENT, attributes }, ctx);
+    }
+    endQuerySpan(query, span, reason) {
+        try {
+            // Literals are masked (or the text reduced to its keyword) by the
+            // processor's statement rule as the span ends.
+            const statement = finalStatement(query);
+            if (statement !== '') {
+                span.setAttribute('db.query.text', statement);
+            }
+            if (reason !== undefined) {
+                // The server's message can quote the input that failed ("invalid
+                // input syntax for type integer: ..."), so, as the pg
+                // instrumentation does, only the error's class and SQLSTATE travel.
+                const error = reason;
+                const name = typeof error?.name === 'string' ? error.name.slice(0, 64) : 'Error';
+                const code = typeof error?.code === 'string' ? error.code.slice(0, 16) : '';
+                const message = code === '' ? `${name} from postgres.js` : `${name} from postgres.js (code: ${code})`;
+                span.setStatus({ code: api_1.SpanStatusCode.ERROR, message });
+                span.addEvent('exception', { 'exception.type': name, 'exception.message': message });
+                span.setAttribute('error.type', name);
+                if (code !== '') {
+                    span.setAttribute('db.response.status_code', code);
+                }
+            }
+        }
+        catch {
+            // the span still ends
+        }
+        finally {
+            span.end();
+            delete query[rootcatSpan];
+        }
+    }
+}
+exports.PostgresJsInstrumentation = PostgresJsInstrumentation;
+/** leadingText is the first template part, before any parameter. */
+function leadingText(query) {
+    const strings = query.strings;
+    if (Array.isArray(strings) && typeof strings[0] === 'string') {
+        return strings[0].slice(0, 256);
+    }
+    return '';
+}
+/**
+ * finalStatement is the statement the driver sent: query.statement.string
+ * once built, else the template joined with placeholders for a query the
+ * driver answered without building (an error before the build).
+ */
+function finalStatement(query) {
+    const built = query.statement?.string;
+    if (typeof built === 'string') {
+        return built.slice(0, maxStatementBytes);
+    }
+    const strings = query.strings;
+    if (Array.isArray(strings) && strings.every((part) => typeof part === 'string')) {
+        let text = strings[0] ?? '';
+        for (let i = 1; i < strings.length; i++) {
+            text += '$' + i + strings[i];
+        }
+        return text.slice(0, maxStatementBytes);
+    }
+    return '';
+}
+//# sourceMappingURL=postgresjs.js.map

package/dist/postgresjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresjs.js","sourceRoot":"","sources":["../src/postgresjs.ts"],"names":[],"mappings":";;;AAAA,wEAAwE;AACxE,qEAAqE;AACrE,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,sEAAsE;AACtE,mEAAmE;AACnE,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,cAAc;AACd,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,4BAA4B;AAC5B,4CAAmG;AACnG,oEAAiJ;AACjJ,+CAAkE;AAClE,6CAAgD;AAChD,iDAAkE;AAQlE,cAAc;AACd,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,iBAAiB,GAAG,CAAC,YAAY,CAAC,CAAC;AAwBzC,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;AAC3C,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;AACjD,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAoC,CAAC;AAElI,MAAa,yBAA0B,SAAQ,qCAAsC;IAClE,OAAO,GAAG,IAAI,OAAO,EAAU,CAAC;IACjD,0EAA0E;IACzD,OAAO,GAAG,IAAI,OAAO,EAAmC,CAAC;IAE1E,YAAY,OAA0B;QACpC,KAAK,CAAC,2BAA2B,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAES,IAAI;QACZ,OAAO,IAAI,qDAAmC,CAC5C,UAAU,EACV,iBAAiB,EACjB,CAAC,aAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,EAC3D,CAAC,aAAsB,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAC9D,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,WAAW,CAAC,aAAsB;QACxC,MAAM,EAAE,GAAG,aAAyE,CAAC;QACrF,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,WAAW,CAAC,EAAgC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,EAAE,CAAC,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,OAA0B,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,2CAA2C;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAEO,aAAa,CAAC,aAAsB;QAC1C,MAAM,EAAE,GAAG,aAAsC,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC;QAC5D,MAAM,QAAQ,GAAI,OAA8D,EAAE,CAAC,cAAc,CAAC,CAAC;QACnG,IAAI,QAAQ,IAAI,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,EAAE,CAAC;YAC/C,EAAE,CAAC,OAAO,GAAG,QAAQ,CAAC;QACxB,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,QAAyB;QAC3C,MAAM,MAAM,GAAG,QAAoE,CAAC;QACpF,IAAI,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,eAAe,GAAG,IAAI,CAAC;QAC7B,MAAM,OAAO,GAAG,SAAS,QAAQ,CAAgB,GAAG,IAAe;YACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC;gBACH,eAAe,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAA6D,CAAC;QAC9D,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,cAAc,CAAC,GAAG,QAAQ,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,yEAAyE;IACjE,eAAe,CAAC,GAAgB;QACtC,IAAI,OAAO,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAqB,CAAC;QAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAA0B,CAAC;QACpE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QACD,kEAAkE;QAClE,kDAAkD;QAClD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC1F,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;QAC9C,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,IAAA,2BAAS,EAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAEgB,UAAU,GAAG,CAAC,QAAkD,EAAE,EAAE;QACnF,MAAM,eAAe,GAAG,IAAI,CAAC;QAC7B,OAAO,SAAS,MAAM,CAAkB,GAAG,IAAe;YACxD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,IAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,IAAI,GAAG,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC;YACnB,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;gBAClC,IAAI,CAAC,OAAO,GAAG,UAAU,KAAc;oBACrC,eAAe,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;oBACrD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACnC,CAAC,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,GAAG,UAAU,MAAe;oBACrC,eAAe,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;oBAClD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACnC,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF;;;;OAIG;IACK,UAAU,CAAC,KAAgB;QACjC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC7D,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,KAAK,IAAI,SAAS,CAAC;QAC5B,CAAC;QACD,IAAI,IAAkC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC5B,IAAI,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,wBAAU,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,KAAgB;QACrC,uEAAuE;QACvE,sEAAsE;QACtE,oEAAoE;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI,aAAO,CAAC,MAAM,EAAE,CAAC;QACpG,IAAI,IAAA,wBAAS,EAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC,CAAC,yCAAyC;QAC7D,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,IAAA,6BAAgB,EAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,MAAM,UAAU,GAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC;QAClE,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACnB,UAAU,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACzC,UAAU,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;YAChD,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1E,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,UAAU,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC;YACtC,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1E,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,UAAU,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC;YACnC,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,OAAO,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,cAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;IACjF,CAAC;IAEO,YAAY,CAAC,KAAgB,EAAE,IAAU,EAAE,MAAe;QAChE,IAAI,CAAC;YACH,kEAAkE;YAClE,+CAA+C;YAC/C,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBACrB,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,iEAAiE;gBACjE,sDAAsD;gBACtD,oEAAoE;gBACpE,MAAM,KAAK,GAAG,MAA4C,CAAC;gBAC3D,MAAM,IAAI,GAAG,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;gBACjF,MAAM,IAAI,GAAG,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,MAAM,OAAO,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC,CAAC,GAAG,IAAI,4BAA4B,IAAI,GAAG,CAAC;gBACtG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,oBAAc,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBACxD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC;gBACrF,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;gBACtC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;oBAChB,IAAI,CAAC,YAAY,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,WAAW,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;CACF;AAzND,8DAyNC;AAED,oEAAoE;AACpE,SAAS,WAAW,CAAC,KAAgB;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7D,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAgB;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChF,IAAI,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,IAAI,IAAI,GAAG,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/privacy.d.ts

@@ -0,0 +1,38 @@
+import type { Attributes } from '@opentelemetry/api';
+/** StatementMode is what query text keeps: its shape with literals masked, or its first keyword. */
+export type StatementMode = 'masked' | 'off';
+/** urlKeys hold a URL or path whose query, fragment and opaque segments are cut. */
+export declare const urlKeys: readonly ["http.url", "url.full", "http.target", "url.path"];
+/** clearedKeys hold a query string, a client's address or a user agent; they are emptied. */
+export declare const clearedKeys: readonly ["url.query", "http.client_ip", "client.address", "net.peer.ip", "net.sock.peer.addr", "network.peer.address", "user_agent.original", "http.user_agent"];
+/** maxStatementLength bounds the text the masker reads. */
+export declare const maxStatementLength = 4096;
+/** statementKeys hold query text. */
+export declare const statementKeys: readonly ["db.statement", "db.query.text"];
+/**
+ * framesOnly keeps the frame lines of a stack trace ("    at ...") and
+ * drops the message line(s) before them, which can quote input.
+ */
+export declare function framesOnly(stack: string): string;
+/** stripQuery cuts a URL at its query or fragment. */
+export declare function stripQuery(url: string): string;
+/**
+ * maskPath cuts the query and fragment and replaces every segment that
+ * could hold an identifier or a token (numbers, UUIDs, JWTs, reset
+ * tokens, emails, file names) with {id}; the scheme and host of a full
+ * URL are kept.
+ */
+export declare function maskPath(url: string): string;
+/** statementKeyword keeps the first word of a statement, upper-cased. */
+export declare function statementKeyword(statement: string): string;
+/**
+ * maskLiterals replaces every literal in a SQL statement with ?, keeps
+ * identifiers, keywords and placeholders, and drops comments (which
+ * sqlcommenter fills with values).
+ */
+export declare function maskLiterals(statement: string): string;
+/**
+ * scrubbed returns the attribute changes privacy requires for the given
+ * attributes, or undefined when nothing needs changing.
+ */
+export declare function scrubbed(attributes: Attributes, statement: StatementMode): Attributes | undefined;

package/dist/privacy.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.statementKeys = exports.maxStatementLength = exports.clearedKeys = exports.urlKeys = void 0;
+exports.framesOnly = framesOnly;
+exports.stripQuery = stripQuery;
+exports.maskPath = maskPath;
+exports.statementKeyword = statementKeyword;
+exports.maskLiterals = maskLiterals;
+exports.scrubbed = scrubbed;
+/** urlKeys hold a URL or path whose query, fragment and opaque segments are cut. */
+exports.urlKeys = ['http.url', 'url.full', 'http.target', 'url.path'];
+/** clearedKeys hold a query string, a client's address or a user agent; they are emptied. */
+exports.clearedKeys = [
+    'url.query',
+    'http.client_ip',
+    'client.address',
+    'net.peer.ip',
+    'net.sock.peer.addr',
+    'network.peer.address',
+    'user_agent.original',
+    'http.user_agent',
+];
+/** maxStatementLength bounds the text the masker reads. */
+exports.maxStatementLength = 4096;
+/** statementKeys hold query text. */
+exports.statementKeys = ['db.statement', 'db.query.text'];
+/**
+ * framesOnly keeps the frame lines of a stack trace ("    at ...") and
+ * drops the message line(s) before them, which can quote input.
+ */
+function framesOnly(stack) {
+    const lines = stack.split('\n');
+    const first = lines.findIndex((line) => /^\s+at\s/.test(line));
+    if (first <= 0) {
+        return first === 0 ? stack : '';
+    }
+    return lines.slice(first).join('\n');
+}
+/** stripQuery cuts a URL at its query or fragment. */
+function stripQuery(url) {
+    const cut = url.search(/[?#]/);
+    return cut < 0 ? url : url.slice(0, cut);
+}
+/**
+ * keptSegment reports whether a path segment can hold no secret: a name
+ * of letters, hyphens and underscores up to 32 bytes that is not a
+ * mixed-case run of twelve or more (a base62 token without digits), or a
+ * version (v1, api2). The agent's request capture keeps the same.
+ */
+function keptSegment(segment) {
+    if (/^[A-Za-z]{1,4}\d{1,3}$/.test(segment)) {
+        return true;
+    }
+    if (!/^[A-Za-z_-]{1,32}$/.test(segment)) {
+        return false;
+    }
+    return !(segment.length >= 12 && /[a-z]/.test(segment) && /[A-Z]/.test(segment));
+}
+/**
+ * maskPath cuts the query and fragment and replaces every segment that
+ * could hold an identifier or a token (numbers, UUIDs, JWTs, reset
+ * tokens, emails, file names) with {id}; the scheme and host of a full
+ * URL are kept.
+ */
+function maskPath(url) {
+    const bare = stripQuery(url);
+    const origin = /^[a-z][a-z0-9+.-]*:\/\/[^/]*/i.exec(bare);
+    const prefix = origin ? origin[0] : '';
+    const rest = bare.slice(prefix.length);
+    const masked = rest
+        .split('/')
+        .map((segment) => (segment === '' || keptSegment(segment) ? segment : '{id}'))
+        .join('/');
+    return prefix + masked;
+}
+/** statementKeyword keeps the first word of a statement, upper-cased. */
+function statementKeyword(statement) {
+    const match = /^\s*(?:\/\*.*?\*\/\s*)*([A-Za-z]+)/.exec(statement);
+    return match ? match[1].toUpperCase() : '';
+}
+// One pass over the text: quoted identifiers are kept, comments dropped,
+// string, dollar-quoted and numeric literals masked. $1-style
+// placeholders are kept (a dollar quote's tag cannot start with a digit,
+// and a number right after $ is not a literal).
+// A string or dollar quote left open (a statement cut at its bound) is
+// masked to the end.
+// An E'' string's E must start a word (in LIKE'%x%' the E ends a keyword).
+// Numbers: decimal with or without digits on either side of the point
+// (1, 1.5, 1., .5), with an exponent, or hexadecimal (0xDEAD).
+const sqlTokens = /("(?:[^"]|"")*"|`(?:[^`]|``)*`)|(--[^\n]*|\/\*[\s\S]*?\*\/)|((?<!\w)[Ee]'(?:[^'\\]|\\.|'')*'|'(?:[^']|'')*'|\$([A-Za-z_][A-Za-z0-9_]*)?\$[\s\S]*?\$\4\$|(?<!\w)[Ee]'[\s\S]*$|'[\s\S]*$|\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$[\s\S]*$)|((?<![\w$.])(?:0[xX][0-9a-fA-F]+|(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?)(?![\w.]))/g;
+/**
+ * maskLiterals replaces every literal in a SQL statement with ?, keeps
+ * identifiers, keywords and placeholders, and drops comments (which
+ * sqlcommenter fills with values).
+ */
+function maskLiterals(statement) {
+    return statement
+        .replace(sqlTokens, (_match, identifier, comment) => {
+        if (identifier !== undefined) {
+            return identifier;
+        }
+        if (comment !== undefined) {
+            return '';
+        }
+        return '?';
+    })
+        .trim();
+}
+/**
+ * scrubbed returns the attribute changes privacy requires for the given
+ * attributes, or undefined when nothing needs changing.
+ */
+function scrubbed(attributes, statement) {
+    let changes;
+    const set = (key, value) => {
+        (changes ??= {})[key] = value;
+    };
+    for (const key of exports.urlKeys) {
+        const value = attributes[key];
+        if (typeof value === 'string' && value !== '') {
+            const masked = maskPath(value);
+            if (masked !== value) {
+                set(key, masked);
+            }
+        }
+    }
+    for (const key of exports.clearedKeys) {
+        const value = attributes[key];
+        if (typeof value === 'string' && value !== '') {
+            set(key, '');
+        }
+    }
+    for (const key of exports.statementKeys) {
+        const value = attributes[key];
+        if (typeof value === 'string' && value !== '') {
+            // The span limits bound attribute values; the masker never runs over
+            // more than that, whatever set the attribute.
+            const bounded = value.length > exports.maxStatementLength ? value.slice(0, exports.maxStatementLength) : value;
+            const kept = statement === 'off' ? statementKeyword(bounded) : maskLiterals(bounded);
+            if (kept !== value) {
+                set(key, kept);
+            }
+        }
+    }
+    return changes;
+}
+//# sourceMappingURL=privacy.js.map

package/dist/privacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy.js","sourceRoot":"","sources":["../src/privacy.ts"],"names":[],"mappings":";;;AAmCA,gCAOC;AAGD,gCAGC;AAwBD,4BAUC;AAGD,4CAGC;AAmBD,oCAYC;AAMD,4BAiCC;AApJD,oFAAoF;AACvE,QAAA,OAAO,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,CAAU,CAAC;AAEpF,6FAA6F;AAChF,QAAA,WAAW,GAAG;IACzB,WAAW;IACX,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,iBAAiB;CACT,CAAC;AAEX,2DAA2D;AAC9C,QAAA,kBAAkB,GAAG,IAAI,CAAC;AAEvC,qCAAqC;AACxB,QAAA,aAAa,GAAG,CAAC,cAAc,EAAE,eAAe,CAAU,CAAC;AAExE;;;GAGG;AACH,SAAgB,UAAU,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,sDAAsD;AACtD,SAAgB,UAAU,CAAC,GAAW;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,SAAgB,QAAQ,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,EAAE,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;SAC7E,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,MAAM,GAAG,MAAM,CAAC;AACzB,CAAC;AAED,yEAAyE;AACzE,SAAgB,gBAAgB,CAAC,SAAiB;IAChD,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,yEAAyE;AACzE,8DAA8D;AAC9D,yEAAyE;AACzE,gDAAgD;AAChD,uEAAuE;AACvE,qBAAqB;AACrB,2EAA2E;AAC3E,sEAAsE;AACtE,+DAA+D;AAC/D,MAAM,SAAS,GACb,mTAAmT,CAAC;AAEtT;;;;GAIG;AACH,SAAgB,YAAY,CAAC,SAAiB;IAC5C,OAAO,SAAS;SACb,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,UAA8B,EAAE,OAA2B,EAAE,EAAE;QAC1F,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;SACD,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,UAAsB,EAAE,SAAwB;IACvE,IAAI,OAA+B,CAAC;IACpC,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,KAAqB,EAAE,EAAE;QACjD,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAChC,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,eAAO,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrB,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,mBAAW,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,qBAAa,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,qEAAqE;YACrE,8CAA8C;YAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,0BAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,0BAAkB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAC/F,MAAM,IAAI,GAAG,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACrF,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}